Re: (subset) [PATCH v3 1/3] soc: qcom: apr: Reject packets with header size larger than packet size

[Bjorn Andersson]

On Tue, 03 Nov 2026 15:56:36 +0100, Krzysztof Kozlowski wrote:
> apr_do_rx_callback() and gpr_do_rx_callback() validate the header size
> and the packet size separately, but never check that the header fits
> within the packet.  Both sizes are u16, so with a malformed packet where
> the header size exceeds the packet size, the subtraction computing
> resp.payload_size gets promoted to int and becomes negative.
> 
> Further check "resp.payload_size > 0" would fail, leading to
> resp.payload left uninitialized (stack value).  Reject such packets as
> having a wrong packet size, although unlikely that firmware would
> produce such packets.
> 
> [...]

Applied, thanks!

[1/3] soc: qcom: apr: Reject packets with header size larger than packet size
      commit: e6f64f9b76d595cdd697dcf345860a8317b09d2f
[2/3] soc: qcom: apr: Fix theoretical use-after-free of GPR port on concurrent RX callback
      commit: a5d51dee5f570362f262301dcdab66ebb6aaf634
[3/3] soc: qcom: apr: Narrow critical section in error path of gpr_alloc_port()
      commit: 85fadab9958b7eb5a70c53887a90c2e6fc26367c

Best regards,
-- 
Bjorn Andersson <andersson@xxxxxxxxxx>