[PATCH] arm: imx: hab: validate HAB M4 event length before memcpy()

From: Ngo Luong Thanh Tra <[email protected]>

get_hab_status_m4() copies each HAB_TAG_EVT record from the HAB M4
persistent memory region into a fixed 128-byte stack buffer using a
length taken straight from the record header:

	record_len = get_record_len(rec);
	if (rec->tag == HAB_TAG_EVT)
		memcpy(&event_data, rec, record_len);

get_record_len() builds a 16-bit big-endian value from rec->len[], so
record_len can be up to 65535, while event_data is 128 bytes. A record
advertising a length above 128 therefore overflows the stack buffer. The
A7 path in get_hab_status() does not have this problem because it passes
sizeof(event_data) to hab_rvt_report_event() as an in/out bound.

A zero-length record is also mishandled: offset += record_len leaves
offset unchanged and the parse loop never terminates.

Reject records whose length is zero or which extend past the end of the
persistent memory region, and reject events larger than the destination
buffer, before the copy is made. An invalid record means the region is
corrupt, so abort the listing rather than continue, matching the
existing handling of an invalid HAB_TAG_EVT_DEF header.

Fixes: 58f75efeaf30 ("mx7ulp: hab: Add hab_status command for HABv4 M4 boot")
Signed-off-by: Ngo Luong Thanh Tra <[email protected]>
Cc: Stefano Babic <[email protected]>
Cc: Fabio Estevam <[email protected]>
Cc: NXP i.MX U-Boot Team <[email protected]>
Cc: Tom Rini <[email protected]>
---
 arch/arm/mach-imx/hab.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/arm/mach-imx/hab.c b/arch/arm/mach-imx/hab.c
index ab5861578e..f92f77670a 100644
--- a/arch/arm/mach-imx/hab.c
+++ b/arch/arm/mach-imx/hab.c
@@ -541,7 +541,19 @@ static int get_hab_status_m4(void)
 
 		record_len = get_record_len(rec);
 
+		if (!record_len ||
+		    offset + record_len > HAB_M4_PERSISTENT_BYTES) {
+			puts("\nERROR: Invalid HAB record length\n");
+			return 1;
+		}
+
 		if (rec->tag == HAB_TAG_EVT) {
+			if (record_len > sizeof(event_data)) {
+				printf("\nERROR: HAB event %d too large (%zu bytes)\n",
+				       index + 1, record_len);
+				return 1;
+			}
+
 			memcpy(&event_data, rec, record_len);
 			puts("\n");
 			printf("--------- HAB Event %d -----------------\n",

base-commit: ece349ade2973e220f524ce59e59711cc919263f
-- 
2.53.0