On Thu, 16 Jul 2026 16:39:38 +0200
Osama Abdelkader <[email protected]> wrote:
> In panthor_fw_load_section_entry(), the data size to copy is calculated
> without validating it against the allocated section_size:
>
> section->data.size = hdr.data.end - hdr.data.start;
>
> If a crafted firmware sets data.size larger than the allocated memory,
> this could cause a heap buffer overflow in panthor_fw_init_section_mem()
>
> memcpy(section->mem->kmap, section->data.buf, section->data.size);
>
> Additionally, if the section->data.size exceeds the BO size, could this
> memset underflow the size calculation, leading to a massive out-of-bounds
> zeroing of kernel memory?
>
> memset(section->mem->kmap + section->data.size, 0,
> panthor_kernel_bo_size(section->mem) - section->data.size);
>
> Reject section entries whose initial data is larger than the section size.
>
> Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
> Cc: [email protected]
> Signed-off-by: Osama Abdelkader <[email protected]>
Reviewed-by: Boris Brezillon <[email protected]>
> ---
> drivers/gpu/drm/panthor/panthor_fw.c | 11 +++++++++--
> 1 file changed, 9 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/panthor/panthor_fw.c
> b/drivers/gpu/drm/panthor/panthor_fw.c
> index 986151681b24..a338c4f0a7f5 100644
> --- a/drivers/gpu/drm/panthor/panthor_fw.c
> +++ b/drivers/gpu/drm/panthor/panthor_fw.c
> @@ -545,6 +545,7 @@ static int panthor_fw_load_section_entry(struct
> panthor_device *ptdev,
> struct panthor_fw_binary_section_entry_hdr hdr;
> struct panthor_fw_section *section;
> u32 section_size;
> + u32 data_size;
> u32 name_len;
> int ret;
>
> @@ -595,6 +596,13 @@ static int panthor_fw_load_section_entry(struct
> panthor_device *ptdev,
> return -EINVAL;
> }
>
> + section_size = hdr.va.end - hdr.va.start;
> + data_size = hdr.data.end - hdr.data.start;
> + if (data_size > section_size) {
> + drm_err(&ptdev->base, "Firmware corrupted, section data exceeds
> section size\n");
> + return -EINVAL;
> + }
> +
> name_len = iter->size - iter->offset;
>
> section = drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL);
> @@ -603,7 +611,7 @@ static int panthor_fw_load_section_entry(struct
> panthor_device *ptdev,
>
> list_add_tail(§ion->node, &ptdev->fw->sections);
> section->flags = hdr.flags;
> - section->data.size = hdr.data.end - hdr.data.start;
> + section->data.size = data_size;
>
> if (section->data.size > 0) {
> void *data = drmm_kmalloc(&ptdev->base, section->data.size,
> GFP_KERNEL);
> @@ -626,7 +634,6 @@ static int panthor_fw_load_section_entry(struct
> panthor_device *ptdev,
> section->name = name;
> }
>
> - section_size = hdr.va.end - hdr.va.start;
> if (section_size) {
> u32 cache_mode = hdr.flags &
> CSF_FW_BINARY_IFACE_ENTRY_CACHE_MODE_MASK;
> struct panthor_gem_object *bo;
