remoteproc: qcom_q6v5_mss: Validate p_filesz in ELF loader

Analog to the issue in the common mdt_loader code the MSS ELF loader
does not validate that p_filesz bytes will fit in the memory region and
that the loaded segments are not truncated. Fix this in the same way
as proposed for the mdt_loader.

Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Fixes: 135b9e8d1cd8 ("remoteproc: qcom_q6v5_mss: Validate modem blob firmware size before load")
Link: https://lore.kernel.org/r/20210312232002.3466791-1-bjorn.andersson@linaro.org
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>

diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index 15abfbb..423b31d 100644 (file)
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -1210,6 +1210,14 @@ static int q6v5_mpss_load(struct q6v5 *qproc)
                        goto release_firmware;
                }
 
+               if (phdr->p_filesz > phdr->p_memsz) {
+                       dev_err(qproc->dev,
+                               "refusing to load segment %d with p_filesz > p_memsz\n",
+                               i);
+                       ret = -EINVAL;
+                       goto release_firmware;
+               }
+
                ptr = memremap(qproc->mpss_phys + offset, phdr->p_memsz, MEMREMAP_WC);
                if (!ptr) {
                        dev_err(qproc->dev,
@@ -1241,6 +1249,16 @@ static int q6v5_mpss_load(struct q6v5 *qproc)
                                goto release_firmware;
                        }
 
+                       if (seg_fw->size != phdr->p_filesz) {
+                               dev_err(qproc->dev,
+                                       "failed to load segment %d from truncated file %s\n",
+                                       i, fw_name);
+                               ret = -EINVAL;
+                               release_firmware(seg_fw);
+                               memunmap(ptr);
+                               goto release_firmware;
+                       }
+
                        release_firmware(seg_fw);
                }