linux-kernel - [PATCH 1/2] remoteproc: elf_loader: skip segment with memsz as zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220323064944.1351923-2-peng.fan@oss.nxp.com>
Date:   Wed, 23 Mar 2022 14:49:43 +0800
From:   "Peng Fan (OSS)" <peng.fan@....nxp.com>
To:     bjorn.andersson@...aro.org, mathieu.poirier@...aro.org,
        shawnguo@...nel.org, s.hauer@...gutronix.de, shengjiu.wang@....com
Cc:     linux-remoteproc@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel@...gutronix.de, festevam@...il.com, linux-imx@....com,
        linux-arm-kernel@...ts.infradead.org, Peng Fan <peng.fan@....com>
Subject: [PATCH 1/2] remoteproc: elf_loader: skip segment with memsz as zero

From: Peng Fan <peng.fan@....com>

Per elf specification,
p_filesz: This member gives the number of bytes in the file image of
the segment; it may be zero.
p_memsz: This member gives the number of bytes in the memory image
of the segment; it may be zero.

There is a case that i.MX DSP firmware has segment with PT_LOAD and
p_memsz/p_filesz set to zero. Such segment needs to be ignored,
otherwize rproc_da_to_va would report error.

Signed-off-by: Peng Fan <peng.fan@....com>
---
 drivers/remoteproc/remoteproc_elf_loader.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/remoteproc/remoteproc_elf_loader.c b/drivers/remoteproc/remoteproc_elf_loader.c
index d635d19a5aa8..cb77f9e4dc70 100644
--- a/drivers/remoteproc/remoteproc_elf_loader.c
+++ b/drivers/remoteproc/remoteproc_elf_loader.c
@@ -181,7 +181,14 @@ int rproc_elf_load_segments(struct rproc *rproc, const struct firmware *fw)
 		bool is_iomem = false;
 		void *ptr;
 
-		if (type != PT_LOAD)
+		/*
+		 *  There is a case that with PT_LOAD type, the
+		 *  filesz = memsz = 0. If memsz = 0, rproc_da_to_va
+		 *  should return NULL ptr, then error is returned.
+		 *  So this case should be skipped from the loop.
+		 *  Add !memsz checking here.
+		 */
+		if (type != PT_LOAD || !memsz)
 			continue;
 
 		dev_dbg(dev, "phdr: type %d da 0x%llx memsz 0x%llx filesz 0x%llx\n",
-- 
2.25.1