Commit 9f9967fe authored by Bjorn Andersson's avatar Bjorn Andersson Committed by Bjorn Andersson
Browse files

soc: qcom: mdt_loader: Ensure we don't read past the ELF header



When the MDT loader is used in remoteproc, the ELF header is sanitized
beforehand, but that's not necessary the case for other clients.

Validate the size of the firmware buffer to ensure that we don't read
past the end as we iterate over the header. e_phentsize and e_shentsize
are validated as well, to ensure that the assumptions about step size in
the traversal are valid.

Fixes: 2aad40d9 ("remoteproc: Move qcom_mdt_loader into drivers/soc/qcom")
Cc: stable@vger.kernel.org
Reported-by: default avatarDoug Anderson <dianders@chromium.org>
Signed-off-by: default avatarBjorn Andersson <bjorn.andersson@oss.qualcomm.com>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-1-f7073e9ab899@oss.qualcomm.com


Signed-off-by: default avatarBjorn Andersson <andersson@kernel.org>
parent 19272b37
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment