diff options
| author | Justin Chen <justin.chen@broadcom.com> | 2026-08-26 13:14:59 -0700 |
|---|---|---|
| committer | Krzysztof Kozlowski <krzk@kernel.org> | 2026-09-01 17:38:29 +0200 |
| commit | 6b07f8c06caca015a0db69e3f323b5186469bc66 (patch) | |
| tree | 62f1e6c54febc01f78276f43d77cac94f2add287 /tools/perf/scripts/python/stackcollapse.py | |
| parent | 7c0b82d087908765c6c7daeb06943e21b78d523e (diff) | |
memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT
A compromised or buggy DCPU coprocessor can make any user who reads
world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel
stack out-of-bounds read of arbitrary extent. This bounds checks
chksum_idx against MSG_FIELD_MAX after reading the response from DCPU
message RAM.
Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time")
Cc: stable@vger.kernel.org
Signed-off-by: Justin Chen <justin.chen@broadcom.com>
Assisted-by: Gemini:gemini-3.1-pro-preview cursor
Signed-off-by: Danesh Petigara <danesh.petigara@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20260826201500.3000125-3-danesh.petigara@broadcom.com
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions