linux-kernel - Re: [PATCH] misc: bcm-vk: validate entry_size before memcpy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CA+Jzhd+FtvomRV39pKfqUB040D9L08XH4eY=WQF2ZzTsEbNepg@mail.gmail.com>
Date: Mon, 22 Dec 2025 08:41:28 -0800
From: Scott Branden <scott.branden@...adcom.com>
To: Guangshuo Li <lgs201920130244@...il.com>
Cc: Arnd Bergmann <arnd@...db.de>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, 
	Olof Johansson <olof@...om.net>, Desmond Yan <desmond.yan@...adcom.com>, 
	bcm-kernel-feedback-list@...adcom.com, linux-kernel@...r.kernel.org, 
	stable@...r.kernel.org
Subject: Re: [PATCH] misc: bcm-vk: validate entry_size before memcpy_fromio()

On Fri, Dec 19, 2025 at 6:12 AM Guangshuo Li <lgs201920130244@...il.com> wrote:
>
> The driver trusts the 'num' and 'entry_size' fields read from BAR2 and
> uses them directly to compute the length for memcpy_fromio() without
> any bounds checking. If these fields get corrupted or otherwise contain
> invalid values, num * entry_size can exceed the size of
> proc_mon_info.entries and lead to a potential out-of-bounds write.
>
> Add validation for 'entry_size' by ensuring it is non-zero and that
> num * entry_size does not exceed the size of proc_mon_info.entries.
>
> Fixes: ff428d052b3b ("misc: bcm-vk: add get_card_info, peerlog_info, and proc_mon_info")
> Cc: stable@...r.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@...il.com>
Acked-by: Scott Branden <scott.branden@...adcom.com>
> ---
>  drivers/misc/bcm-vk/bcm_vk_dev.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/misc/bcm-vk/bcm_vk_dev.c b/drivers/misc/bcm-vk/bcm_vk_dev.c
> index a16b99bdaa13..a4a74c10f02b 100644
> --- a/drivers/misc/bcm-vk/bcm_vk_dev.c
> +++ b/drivers/misc/bcm-vk/bcm_vk_dev.c
> @@ -439,6 +439,7 @@ static void bcm_vk_get_proc_mon_info(struct bcm_vk *vk)
>         struct device *dev = &vk->pdev->dev;
>         struct bcm_vk_proc_mon_info *mon = &vk->proc_mon_info;
>         u32 num, entry_size, offset, buf_size;
> +       size_t max_bytes;
>         u8 *dst;
>
>         /* calculate offset which is based on peerlog offset */
> @@ -458,6 +459,9 @@ static void bcm_vk_get_proc_mon_info(struct bcm_vk *vk)
>                         num, BCM_VK_PROC_MON_MAX);
>                 return;
>         }
> +       if (!entry_size || (size_t)num > max_bytes / entry_size) {
> +               return;
> +       }
>         mon->num = num;
>         mon->entry_size = entry_size;
>
> --
> 2.43.0
>

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5473 bytes)