llext: check number of module entries in libraries#10924
Conversation
lyakh
requested review from
dbaluta,
kv2019i,
lbetlej,
lgirdwood,
mmaka1 and
plbossart
as code owners
There was a problem hiding this comment.
Pull request overview
This PR aims to harden LLEXT library loading by validating manifest/module-entry bounds to prevent out-of-bounds memory access when enumerating module entries, and by propagating initialization failures back to the library loader.
Changes:
- Add overflow/bounds checks in
llext_manager_mod_init()when computing library size and the end of the module-entry array. - Propagate
llext_manager_mod_init()failures inllext_manager_add_library()instead of ignoring them. - Refactor
llext_manager_add_library()to reuse a singleretvariable forllext_manager_link_single()calls.
|
@lrudyX random HDA DMA again... |
| uintptr_t img_end_addr = (uintptr_t)desc - SOF_MAN_ELF_TEXT_OFFSET + lib_size; | ||
|
|
||
| if (mod_end_addr < (uintptr_t)mod_array || img_end_addr < (uintptr_t)desc || | ||
| mod_end_addr >= img_end_addr) |
There was a problem hiding this comment.
for future: we need unique LOG here and above EOVERFLOW to assist debug.
kv2019i
left a comment
kv2019i
left a comment
There was a problem hiding this comment.
One inline comment to check before merge. But this anyways errs on side of caution, so I'm good to merge.
| size_t offs; | ||
|
|
||
| if (size_mul_overflow(desc->header.preload_page_count, PAGE_SZ, &lib_size)) | ||
| return -EOVERFLOW; |
There was a problem hiding this comment.
@lyakh @lgirdwood Just noticed in #10931 the overflow was not checked. Here we check? Is this needed or not, do we have check elsewhere to guarantee lib_size cannot overflow in u32?
There was a problem hiding this comment.
@kv2019i ok, you win, let's do it right
A corrupted or malformed library can provide the required page count that overflows 32-bit multiplication. Check once when loading. Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Validate module entry number to avoid out of boundary memory access. Signed-off-by: Guennadi Liakhovetski <guennadi.liakhovetski@linux.intel.com>
Validate module entry number to avoid out of boundary memory access.