Bjorn Andersson
1096eb63ec
soc: qcom: mdt_loader: Ensure we don't read past the ELF header ...
[ Upstream commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef ]
When the MDT loader is used in remoteproc, the ELF header is sanitized
beforehand, but that's not necessary the case for other clients.
Validate the size of the firmware buffer to ensure that we don't read
past the end as we iterate over the header. e_phentsize and e_shentsize
are validated as well, to ensure that the assumptions about step size in
the traversal are valid.
Fixes: 2aad40d911stable@vger.kernel.org
Reported-by: Doug Anderson <dianders@chromium.org>
Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-1-f7073e9ab899@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-28 16:21:35 +02:00
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
2025-08-28 16:21:33 +02:00
binder: fix UAF caused by offsets overwrite
2024-09-12 11:03:55 +02:00
ata: libata-scsi: Fix ata_to_sense_error() status handling
2025-08-28 16:21:31 +02:00
atm: idt77252: Add missing dma_map_error()
2025-07-17 18:25:05 +02:00
pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov
2025-08-28 16:21:34 +02:00
drbd: add missing kref_get in handle_write_conflicts
2025-08-28 16:21:24 +02:00
Bluetooth: btrtl: Prevent potential NULL dereference
2025-05-02 07:39:19 +02:00
Revert "bus: ti-sysc: Probe for l4_wkup and l4_cfg interconnect devices first"
2025-06-27 11:02:55 +01:00
ipmi: Fix strcpy source and destination the same
2025-08-28 16:21:29 +02:00
clk: sunxi-ng: v3s: Fix de clock definition
2025-08-28 16:21:20 +02:00
clocksource/i8253: Use raw_spinlock_irqsave() in clockevent_i8253_disable()
2025-06-04 14:32:29 +02:00
counter: stm32-lptimer-cnt: fix error handling when enabling
2025-04-10 14:29:39 +02:00
cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table()
2025-08-28 16:21:30 +02:00
cpuidle: menu: Avoid discarding useful information
2025-06-04 14:32:32 +02:00
crypto: qat - fix seq_file position update in adf_ring_next()
2025-08-28 16:21:21 +02:00
dmaengine: nbpfaxi: Add missing check after DMA map
2025-08-28 16:21:21 +02:00
dma-buf: fix timeout handling in dma_resv_wait_timeout v2
2025-07-17 18:25:04 +02:00
EDAC/altera: Use correct write width with the INTTEST register
2025-06-27 11:02:51 +01:00
firmware: psci: Fix refcount leak in psci_dt_init
2025-06-27 11:02:46 +01:00
fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable()
2025-08-28 16:21:32 +02:00
gpio: tps65912: check the return value of regmap_update_bits()
2025-08-28 16:21:25 +02:00
drm/sched: Remove optimization that causes hang when killing dependent jobs
2025-08-28 16:21:33 +02:00
HID: core: do not bypass hid_hw_raw_request
2025-08-28 16:21:14 +02:00
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition
2025-05-02 07:39:18 +02:00
Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio()
2025-04-10 14:29:35 +02:00
hwmon: (occ) fix unaligned accesses
2025-06-27 11:02:57 +01:00
coresight: catu: Fix number of pages while using 64k pages
2025-04-10 14:29:41 +02:00
i2c: qup: jump out of the loop in case of timeout
2025-08-28 16:21:17 +02:00
i3c: don't fail if GETHDRCAP is unsupported
2025-08-28 16:21:29 +02:00
iio: hid-sensor-prox: Fix incorrect OFFSET calculation
2025-08-28 16:21:33 +02:00
RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()
2025-08-28 16:21:28 +02:00
Input: xpad - set correct controller type for Acer NGR200
2025-08-28 16:21:14 +02:00
iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
2025-06-04 14:32:26 +02:00
irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()
2025-06-04 14:32:25 +02:00
mISDN: Fix a use after free in hfcmulti_tx()
2024-08-19 05:33:42 +02:00
leds: lp8860: Write full EEPROM, not only half of it
2025-03-13 12:43:06 +01:00
macintosh/therm_windtunnel: fix module unload.
2024-08-19 05:33:34 +02:00
mailbox: Not protect module_put with spin_lock_irqsave
2025-07-17 18:24:49 +02:00
mcb: fix a double free bug in chameleon_parse_gdd()
2025-05-02 07:39:26 +02:00
md/raid1: Fix stack memory use after return in raid1_reshape
2025-07-17 18:25:04 +02:00
media: venus: Add a check for packet size after reading from shared memory
2025-08-28 16:21:32 +02:00
memstick: Fix deadlock by moving removing flag earlier
2025-08-28 16:21:32 +02:00
scsi: fusion: Remove unused variable 'rc'
2024-12-14 19:44:29 +01:00
mfd: max14577: Fix wakeup source leaks on device unbind
2025-07-17 18:24:49 +02:00
misc: rtsx: usb: Ensure mmc child device is active when card is present
2025-08-28 16:21:30 +02:00
mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode()
2025-08-28 16:21:25 +02:00
mtd: rawnand: fsmc: Add missing check after DMA map
2025-08-28 16:21:31 +02:00
ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
2025-08-28 16:21:33 +02:00
nfc: pn533: Add poll mod list filling check
2024-09-04 13:15:04 +02:00
ntb: reduce stack usage in idt_scan_mws
2025-05-02 07:39:28 +02:00
libnvdimm/labels: Fix divide error in nd_label_data_init()
2025-06-04 14:32:30 +02:00
nvmet-tcp: don't restore null sk_state_change
2025-06-04 14:32:35 +02:00
nvmem: core: improve range check for nvmem_cell_write()
2025-03-13 12:43:10 +01:00
of: module: add buffer overflow check in of_modalias()
2025-06-04 14:32:25 +02:00
parport_pc: add support for ASIX AX99100
2025-03-13 12:43:19 +01:00
PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports
2025-08-28 16:21:33 +02:00
pcmcia: Use resource_size function on resource object
2024-09-12 11:03:52 +02:00
perf: arm_pmu: Don't disable counter in armpmu_add()
2025-05-02 07:39:09 +02:00
phy: core: don't require set_mode() callback for phy_get_mode() to work
2025-06-04 14:32:33 +02:00
pinctrl: stm32: Manage irq affinity settings
2025-08-28 16:21:28 +02:00
platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches
2025-08-28 16:21:25 +02:00
power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set
2025-08-28 16:21:20 +02:00
powercap: call put_device() on an error path in powercap_register_control_type()
2025-04-10 14:29:36 +02:00
pps: fix poll support
2025-08-28 16:21:18 +02:00
ptp: Ensure info->enable callback is always set
2025-03-13 12:43:11 +01:00
pwm: imx-tpm: Reset counter if CMOD is 0
2025-08-28 16:21:31 +02:00
drivers/rapidio/rio_cm.c: prevent possible heap overwrite
2025-06-27 11:02:56 +01:00
regulator: core: fix NULL dereference on unbind due to stale coupling data
2025-08-28 16:21:17 +02:00
remoteproc: imx_rproc: Skip over memory region when node value is NULL
2024-08-19 05:33:44 +02:00
reset: berlin: fix OF node leak in probe() error path
2024-11-08 16:20:28 +01:00
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send()
2025-06-27 11:02:48 +01:00
rtc: ds1307: handle oscillator stop flag (OSF) for ds1341
2025-08-28 16:21:35 +02:00
scsi: s390: zfcp: Ensure synchronous unit_add
2025-06-27 11:02:56 +01:00
scsi: lpfc: Remove redundant assignment to avoid memory leak
2025-08-28 16:21:30 +02:00
sh: clk: Fix clk_enable() to return 0 on NULL clk
2025-01-09 13:23:29 +01:00
slimbus: messaging: Free transaction ID in delayed interrupt scenario
2025-03-13 12:43:33 +01:00
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
2025-08-28 16:21:35 +02:00
soundwire: stream: restore params when prepare ports fail
2025-08-28 16:21:21 +02:00
spi: spi-fsl-dspi: Clear completion counter before initiating transfer
2025-07-17 18:25:00 +02:00
ssb: Fix division by zero issue in ssb_calc_clock_rate
2024-09-04 13:14:53 +02:00
comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large
2025-08-28 16:21:33 +02:00
scsi: target: iscsi: Fix timeout on deleted connection
2025-06-04 14:32:29 +02:00
tee: Prevent size calculation wraparound on 32-bit kernels
2025-06-27 11:02:55 +01:00
thermal: sysfs: Return ENODATA instead of EAGAIN for reads
2025-08-28 16:21:25 +02:00
thunderbolt: Fix copy+paste error in match_service_id()
2025-08-28 16:21:30 +02:00
vt: defkeymap: Map keycodes above 127 to K_HOLE
2025-08-28 16:21:31 +02:00
uio_hv_generic: Use correct size for interrupt and monitor pages
2025-06-27 11:02:52 +01:00
usb: musb: omap2430: fix device leak at unbind
2025-08-28 16:21:35 +02:00
vfio/pci: Enable iowrite64 and ioread64 for vfio pci
2025-03-13 12:43:13 +01:00
vhost: fail early when __vhost_add_used() fails
2025-08-28 16:21:27 +02:00
Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
2025-08-28 16:21:31 +02:00
watchdog: dw_wdt: Fix default timeout
2025-08-28 16:21:27 +02:00
xen/swiotlb: relax alignment requirements
2025-06-04 14:32:37 +02:00
1096eb63ec