[PATCH 2/2] remoteproc: mtk_scp: Fix bounds check in mt8192_scp_da_to_va()
HOTtoday
From: Atul Akella <hidden>
Date: 2026-10-05 11:11:31
Also in:
linux-mediatek, linux-remoteproc, lkml, stable
Subsystem:
remote processor (remoteproc) subsystem, the rest · Maintainers:
Bjorn Andersson, Mathieu Poirier, Linus Torvalds
mt8192_scp_da_to_va() translates a device address to a pointer into
SCP SRAM, L1TCM or DRAM. Its bounds checks have two problems:
- (da + len) is computed in u64 and wraps for a large da or len.
With da = 0xfffffffffffffff0 and len = 0x20, the sum is 0x10 and
passes "<= base + size" while da >= base also holds.
- offset is an int but is assigned from a u64 difference, so it is
truncated before being added to the region's base pointer.
da and len come from the firmware's ELF program headers
(p_paddr/p_memsz) via rproc_da_to_va(), and the returned pointer is
then written to by the ELF loader, so a malformed firmware image can
make the loader write outside the intended region.
Use a u64 offset and compare len against the remaining region size
instead of adding it to da. Apply this to the SRAM, L1TCM and DRAM
regions.
Fixes: ca23ecfdbd44 ("remoteproc/mediatek: support L1TCM")
Cc: stable@vger.kernel.org
Signed-off-by: Atul Akella <redacted>
---
drivers/remoteproc/mtk_scp.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/remoteproc/mtk_scp.c b/drivers/remoteproc/mtk_scp.c
index d18ae676260a..b1d83265fc26 100644
--- a/drivers/remoteproc/mtk_scp.c
+++ b/drivers/remoteproc/mtk_scp.c@@ -775,30 +775,30 @@ static void *mt8183_scp_da_to_va(struct mtk_scp *scp, u64 da, size_t len) static void *mt8192_scp_da_to_va(struct mtk_scp *scp, u64 da, size_t len) { - int offset; + u64 offset; const struct mtk_scp_sizes_data *scp_sizes; scp_sizes = scp->data->scp_sizes; - if (da >= scp->sram_phys && - (da + len) <= scp->sram_phys + scp->sram_size) { + if (da >= scp->sram_phys) { offset = da - scp->sram_phys; - return (void __force *)scp->sram_base + offset; + if (offset <= scp->sram_size && len <= scp->sram_size - offset) + return (void __force *)scp->sram_base + offset; } /* optional memory region */ - if (scp->cluster->l1tcm_size && - da >= scp->cluster->l1tcm_phys && - (da + len) <= scp->cluster->l1tcm_phys + scp->cluster->l1tcm_size) { + if (scp->cluster->l1tcm_size && da >= scp->cluster->l1tcm_phys) { offset = da - scp->cluster->l1tcm_phys; - return (void __force *)scp->cluster->l1tcm_base + offset; + if (offset <= scp->cluster->l1tcm_size && + len <= scp->cluster->l1tcm_size - offset) + return (void __force *)scp->cluster->l1tcm_base + offset; } /* optional memory region */ - if (scp_sizes->max_dram_size && - da >= scp->dma_addr && - (da + len) <= scp->dma_addr + scp_sizes->max_dram_size) { + if (scp_sizes->max_dram_size && da >= scp->dma_addr) { offset = da - scp->dma_addr; - return scp->cpu_addr + offset; + if (offset <= scp_sizes->max_dram_size && + len <= scp_sizes->max_dram_size - offset) + return scp->cpu_addr + offset; } return NULL;
--
2.43.0