Linmao Li 220190f97d misc: issei: check bus message length before reading the command ... __issei_ham_process_ham_rsp() dispatches on hdr->cmd before the message length is validated. The length comes from the firmware-owned DMA header read in issei_dma_read(), which only bounds it from above, so firmware sending a short bus message reaches the dispatch with less than sizeof(struct ham_bus_message) bytes available. For a zero-length message kmemdup() returns ZERO_SIZE_PTR, which passes the NULL check in issei_dma_read(), and the dispatch dereferences it. A length of one to three bytes gives a slab out-of-bounds read instead. Reject bus messages shorter than the header before touching it, the way the individual response handlers already validate their own length. Fixes: 7bd4b9991d ("issei: implement main thread and ham messages") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260731025952.3505287-1-lilinmao@kylinos.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2026-07-31 14:27:46 +02:00
..
cdev.c
cdev.h
dma.c
dma.h
fw_client.c
fw_client.h
ham.c	misc: issei: check bus message length before reading the command	2026-07-31 14:27:46 +02:00
ham.h	issei: implement main thread and ham messages	2026-07-17 15:48:11 +02:00
host_client.c
host_client.h
hw_heci_regs.h	issei: add heci hardware module	2026-07-17 15:48:11 +02:00
hw_heci.c	issei: Fix size_t printk specifier in heci_{write,read}_buf()	2026-07-31 14:21:26 +02:00
hw_heci.h	issei: add heci hardware module	2026-07-17 15:48:11 +02:00
hw_msg.h
issei_dev.h	issei: implement main thread and ham messages	2026-07-17 15:48:11 +02:00
Kconfig	issei: add heci hardware module	2026-07-17 15:48:11 +02:00
main.c	issei: implement main thread and ham messages	2026-07-17 15:48:11 +02:00
Makefile	issei: add heci hardware module	2026-07-17 15:48:11 +02:00
pci_heci.c	issei: add heci hardware module	2026-07-17 15:48:11 +02:00