github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
master
linux/drivers/accel/qaic
History
Youssef Samir ab243f74ab accel/qaic: Address potential out-of-bounds read in resp_worker() 
Although 'commit 2feec5ae5d ("accel/qaic: Handle DBC deactivation if the
owner went away")' fixes the scenario it was intended for by walking the
message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it
skipped over the bounds checking code that is included in decode_message().
This could lead to issues such as reading past the slab allocation's end,
infinite loops or kernel panics. For those issues to happen, a malformed
wire message is needed to be sent from the device.

Instead of duplicating the bounds checking code already present in
decode_message(), use the function inside resp_worker().

Reported-by: Ruikai Peng <ruikai@pwno.io>
Fixes: 2feec5ae5d ("accel/qaic: Handle DBC deactivation if the owner went away")
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com>
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20260731152344.1905882-1-youssef.abdulrahman@oss.qualcomm.com
2026-08-14 13:09:43 -06:00
..
Kconfig accel/qaic: Collect crashdump from SSR channel 2025-11-07 11:16:51 -07:00
Makefile accel/qaic: Implement basic SSR handling 2025-11-07 11:01:18 -07:00
mhi_controller.c accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
mhi_controller.h accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
qaic_control.c accel/qaic: Address potential out-of-bounds read in resp_worker() 2026-08-14 13:09:43 -06:00
qaic_data.c Linux 7.1-rc5 2026-05-28 09:58:36 +02:00
qaic_debugfs.c accel/qaic: Retain bootlogs that overflow 2026-03-27 11:25:36 -06:00
qaic_debugfs.h accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
qaic_drv.c accel/qaic: kcalloc + kzalloc to kzalloc 2026-05-12 10:20:40 -06:00
qaic_ras.c Linux 7.1-rc5 2026-05-28 09:58:36 +02:00
qaic_ras.h accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
qaic_ssr.c accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
qaic_ssr.h accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
qaic_sysfs.c accel/qaic: Add DMA Bridge Channel(DBC) sysfs and uevents 2025-11-07 10:55:39 -07:00
qaic_timesync.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
qaic_timesync.h accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00
qaic.h accel/qaic: kcalloc + kzalloc to kzalloc 2026-05-12 10:20:40 -06:00
sahara.c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
sahara.h accel/qaic: Update copyright headers to yearless format 2026-03-27 11:03:08 -06:00