bus: mhi: core: Sanity check values from remote device before use
authorJeffrey Hugo <jhugo@codeaurora.org>
Wed, 10 Mar 2021 21:30:55 +0000 (14:30 -0700)
committerManivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Thu, 8 Apr 2021 06:27:38 +0000 (11:57 +0530)
commitec32332df7645e0ba463a08d483fe97665167071
treeb4e595d1681ab4560fc99b3dfb345bed0d88707e
parent11134390d742bd22e574d03280fe0ec8d3d4974e
bus: mhi: core: Sanity check values from remote device before use

When parsing the structures in the shared memory, there are values which
come from the remote device.  For example, a transfer completion event
will have a pointer to the tre in the relevant channel's transfer ring.
As another example, event ring elements may specify a channel in which
the event occurred, however the specified channel value may not be valid
as no channel is defined at that index even though the index may be less
than the maximum allowed index.  Such values should be considered to be
untrusted, and validated before use.  If we blindly use such values, we
may access invalid data or crash if the values are corrupted.

If validation fails, drop the relevant event.

Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Hemant Kumar <hemantk@codeaurora.org>
Link: https://lore.kernel.org/r/1615411855-15053-1-git-send-email-jhugo@codeaurora.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
drivers/bus/mhi/core/main.c