linux-kernel - Re: [PATCH v2] misc: fastrpc: Remove user PD initmem size check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 28 Jun 2024 16:12:10 +0530
From: Ekansh Gupta <quic_ekangupt@...cinc.com>
To: Dmitry Baryshkov <dmitry.baryshkov@...aro.org>
CC: <srinivas.kandagatla@...aro.org>, <linux-arm-msm@...r.kernel.org>,
        <gregkh@...uxfoundation.org>, <quic_bkumar@...cinc.com>,
        <linux-kernel@...r.kernel.org>, <quic_chennak@...cinc.com>,
        <dri-devel@...ts.freedesktop.org>, <arnd@...db.de>,
        stable
	<stable@...nel.org>
Subject: Re: [PATCH v2] misc: fastrpc: Remove user PD initmem size check



On 6/28/2024 3:59 PM, Ekansh Gupta wrote:
>
> On 6/27/2024 4:43 PM, Dmitry Baryshkov wrote:
>> On Thu, Jun 27, 2024 at 11:35:18AM GMT, Ekansh Gupta wrote:
>>> For user PD initialization, initmem is allocated and sent to DSP for
>>> initial memory requirements like shell loading. This size is passed
>>> by user space and is checked against a max size. For unsigned PD
>>> offloading, more than 2MB size could be passed by user which would
>>> result in PD initialization failure. Remove the user PD initmem size
>>> check and allow buffer allocation for user passed size. Any additional
>>> memory sent to DSP during PD init is used as the PD heap.
>> Would it allow malicious userspace to allocate big enough buffers and
>> reduce the amount of memory available to the system? To other DSP
>> programs?
> The allocation here is happening from SMMU context bank which is uniquely assigned
> to processes going to DSP. As per my understanding process can allocate maximum
> 4GB of memory from the context bank and the memory availability will be taken care
> by kernel memory management. Please correct me if my understanding is incorrect.
Just wanted to add 1 question here:
User space can also directly allocate memory. Wouldn't that be a problem if any malicious userspace
allocated huge memory? Is there any bound check or is it handled differently? Please help me with
some information here.
> --Ekansh
>>> Fixes: 7f1f481263c3 ("misc: fastrpc: check before loading process to the DSP")
>>> Cc: stable <stable@...nel.org>
>>> Signed-off-by: Ekansh Gupta <quic_ekangupt@...cinc.com>
>>> ---
>>> Changes in v2:
>>>   - Modified commit text.
>>>   - Removed size check instead of updating max file size.
>>>
>>>  drivers/misc/fastrpc.c | 5 -----
>>>  1 file changed, 5 deletions(-)
>>>
>>> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
>>> index 5204fda51da3..9d064deeac89 100644
>>> --- a/drivers/misc/fastrpc.c
>>> +++ b/drivers/misc/fastrpc.c
>>> @@ -1389,11 +1389,6 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
>>>  		goto err;
>>>  	}
>>>  
>>> -	if (init.filelen > INIT_FILELEN_MAX) {
>>> -		err = -EINVAL;
>>> -		goto err;
>>> -	}
>>> -
>>>  	inbuf.pgid = fl->tgid;
>>>  	inbuf.namelen = strlen(current->comm) + 1;
>>>  	inbuf.filelen = init.filelen;
>>> -- 
>>> 2.34.1
>>>
>