linux-kernel - [PATCH 1/2] drm/imagination: Improve handling of unknown FWCCB commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260206-improve-bad-fwccb-cmd-v1-1-831a852ca127@imgtec.com>
Date: Fri, 6 Feb 2026 16:02:12 +0000
From: Matt Coster <matt.coster@...tec.com>
To: Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Maxime Ripard
	<mripard@...nel.org>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        David Airlie
	<airlied@...il.com>, Simona Vetter <simona@...ll.ch>
CC: Frank Binns <frank.binns@...tec.com>,
        Brajesh Gupta
	<brajesh.gupta@...tec.com>,
        Alessio Belle <alessio.belle@...tec.com>,
        Alexandru Dadu <alexandru.dadu@...tec.com>,
        <dri-devel@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>,
        "Matt
 Coster" <matt.coster@...tec.com>
Subject: [PATCH 1/2] drm/imagination: Improve handling of unknown FWCCB
 commands

A couple small changes:
 - Validate the magic value at the head of FWCCB commands, and
 - Mask off the magic value before logging unknown command types to make
   them easier to interpret on sight.

Signed-off-by: Matt Coster <matt.coster@...tec.com>
---
 drivers/gpu/drm/imagination/pvr_ccb.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/imagination/pvr_ccb.c b/drivers/gpu/drm/imagination/pvr_ccb.c
index 9294b4ba1de7..2f4356a1e69f 100644
--- a/drivers/gpu/drm/imagination/pvr_ccb.c
+++ b/drivers/gpu/drm/imagination/pvr_ccb.c
@@ -136,6 +136,14 @@ pvr_ccb_slot_available_locked(struct pvr_ccb *pvr_ccb, u32 *write_offset)
 static void
 process_fwccb_command(struct pvr_device *pvr_dev, struct rogue_fwif_fwccb_cmd *cmd)
 {
+	struct drm_device *drm_dev = from_pvr_device(pvr_dev);
+
+	if ((cmd->cmd_type & ROGUE_CMD_MAGIC_DWORD_MASK) != ROGUE_CMD_MAGIC_DWORD_SHIFTED) {
+		drm_warn_once(drm_dev, "Received FWCCB command with bad magic value; ignoring (type=0x%08x)\n",
+			      cmd->cmd_type);
+		return;
+	}
+
 	switch (cmd->cmd_type) {
 	case ROGUE_FWIF_FWCCB_CMD_REQUEST_GPU_RESTART:
 		pvr_power_reset(pvr_dev, false);
@@ -151,8 +159,8 @@ process_fwccb_command(struct pvr_device *pvr_dev, struct rogue_fwif_fwccb_cmd *c
 		break;
 
 	default:
-		drm_info(from_pvr_device(pvr_dev), "Received unknown FWCCB command %x\n",
-			 cmd->cmd_type);
+		drm_info(drm_dev, "Received unknown FWCCB command (type=%d)\n",
+			 cmd->cmd_type & ~ROGUE_CMD_MAGIC_DWORD_MASK);
 		break;
 	}
 }

-- 
2.52.0