From 7b1a1af4556a4f95ef273e91435fe804cbfcd223 Mon Sep 17 00:00:00 2001 From: Titouan Ameline de Cadeville Date: Sun, 26 Apr 2026 23:47:39 +0200 Subject: [PATCH 1/2] firmware: google: Add bounds checks in coreboot_table_populate() coreboot_table_populate() iterates over firmware-provided table entries with no validation that the entries stay within the mapped memory region. A corrupt table with a large `entry->size` advances `ptr_entry` past the mapped region, causing an out-of-bounds read on the next iteration. Add a check before dereferencing `ptr_entry` to ensure the entry header is readable, and a second check after reading `entry->size` to ensure the full entry stays within the mapped region. Pass `len` from coreboot_table_probe() into coreboot_table_populate() to make the mapped region size available for validation. Signed-off-by: Titouan Ameline de Cadeville Reviewed-by: Julius Werner Link: https://lore.kernel.org/r/20260426214739.117131-1-titouan.ameline@gmail.com Signed-off-by: Tzung-Bi Shih --- drivers/firmware/google/coreboot_table.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c index c769631ea15d..233939e548b4 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -112,16 +112,20 @@ void coreboot_driver_unregister(struct coreboot_driver *driver) } EXPORT_SYMBOL(coreboot_driver_unregister); -static int coreboot_table_populate(struct device *dev, void *ptr) +static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_t len) { int i, ret; void *ptr_entry; struct coreboot_device *device; struct coreboot_table_entry *entry; struct coreboot_table_header *header = ptr; + void *ptr_end; + ptr_end = ptr + len; ptr_entry = ptr + header->header_bytes; for (i = 0; i < header->table_entries; i++) { + if (ptr_entry + sizeof(*entry) > ptr_end) + return -EINVAL; entry = ptr_entry; if (entry->size < sizeof(*entry)) { @@ -129,6 +133,9 @@ static int coreboot_table_populate(struct device *dev, void *ptr) return -EINVAL; } + if (ptr_entry + entry->size > ptr_end) + return -EINVAL; + device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL); if (!device) return -ENOMEM; @@ -194,7 +201,7 @@ static int coreboot_table_probe(struct platform_device *pdev) if (!ptr) return -ENOMEM; - ret = coreboot_table_populate(dev, ptr); + ret = coreboot_table_populate(dev, ptr, len); memunmap(ptr); From 86e3bbc716332600e9e087f8a4889f4d9714a99c Mon Sep 17 00:00:00 2001 From: Titouan Ameline de Cadeville Date: Fri, 1 May 2026 11:43:22 +0200 Subject: [PATCH 2/2] firmware: google: Skip failing entries instead of aborting populate coreboot_table_populate() registers devices one by one. If device_register() fails for one entry, the current code returns immediately, leaving previously registered devices orphaned on the coreboot bus with no cleanup path. Since coreboot table entries are independent of each other, a failure on one entry should not prevent the others from being registered. This mirrors the strategy used by of_platform_populate(), which skips individual failures rather than aborting. Move ptr_entry increment before device_register(), log a warning on failure, and continue the loop rather than aborting. Signed-off-by: Titouan Ameline de Cadeville Reviewed-by: Julius Werner Acked-by: Brian Norris Link: https://lore.kernel.org/r/20260501094322.123160-1-titouan.ameline@gmail.com Signed-off-by: Tzung-Bi Shih --- drivers/firmware/google/coreboot_table.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c index 233939e548b4..83f7eedf0b3f 100644 --- a/drivers/firmware/google/coreboot_table.c +++ b/drivers/firmware/google/coreboot_table.c @@ -155,13 +155,13 @@ static int coreboot_table_populate(struct device *dev, void *ptr, resource_size_ break; } + ptr_entry += entry->size; + ret = device_register(&device->dev); if (ret) { + dev_warn(dev, "failed to register coreboot device: %d\n", ret); put_device(&device->dev); - return ret; } - - ptr_entry += entry->size; } return 0;