From 28e935c7d0921ec0ef5f10e82777559a1fb41a00 Mon Sep 17 00:00:00 2001 From: Om Deore Date: Tue, 15 Jul 2025 13:30:42 +0530 Subject: [PATCH] BACKPORT: dsp-kernel: Validate page range with map range before passing to DSP In case of unaligned start address and NOVA flag set, range validation is by-passed. The page size calculated using unaligned address passed by user is aligned to nearest boundary internally which returns page size 4KB more. In order to avoid out of bounds issue, check page range is within map range. Change-Id: Ie2de944206eee0730c8ba081f05b7d7cccc72276 Signed-off-by: Om Deore --- drivers/misc/fastrpc.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 3cf9ba563cfc..c3603eb6f538 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -813,6 +813,22 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx) PAGE_SHIFT; pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE; + /* + * Check for page range overflow and validate page + * range is not greater than map buffer range. + * This prevents potential buffer overflow + * and memory corruption that could be exploited. + */ + if (pages[i].addr > (ULLONG_MAX - pages[i].size) || + (pages[i].addr + pages[i].size) > + (ctx->maps[i]->phys + ctx->maps[i]->size)) { + err = -EFAULT; + dev_err(dev, + "Invalid buffer addr 0x%llx len 0x%llx IPA 0x%llx size 0x%llx fd %d\n", + ctx->args[i].ptr, len, ctx->maps[i]->phys, + ctx->maps[i]->size, ctx->maps[i]->fd); + goto bail; + } } else { if (ctx->olaps[oix].offset == 0) {