Re: [PATCH v3 2/2] media: venus: Fix OOB read due to missing payload bound check

[Vikash Garodia]

On 5/14/2025 7:08 PM, Dikshita Agarwal wrote:
> From: Vedang Nagar <quic_vnagar@xxxxxxxxxxx>
> 
> Currently, The event_seq_changed() handler processes a variable number
> of properties sent by the firmware. The number of properties is indicated
> by the firmware and used to iterate over the payload. However, the
> payload size is not being validated against the actual message length.
> 
> This can lead to out-of-bounds memory access if the firmware provides a
> property count that exceeds the data available in the payload. Such a
> condition can result in kernel crashes or potential information leaks if
> memory beyond the buffer is accessed.
> 
> Fix this by properly validating the remaining size of the payload before
> each property access and updating bounds accordingly as properties are
> parsed.
> 
> This ensures that property parsing is safely bounded within the received
> message buffer and protects against malformed or malicious firmware
> behavior.
> 
> Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)")
> Signed-off-by: Vedang Nagar <quic_vnagar@xxxxxxxxxxx>
> Co-developed-by: Dikshita Agarwal <quic_dikshita@xxxxxxxxxxx>
> Signed-off-by: Dikshita Agarwal <quic_dikshita@xxxxxxxxxxx>

Reviewed-by: Vikash Garodia <quic_vgarodia@xxxxxxxxxxx>