Branch: refs/heads/main Home: https://github.com/OpenAMP/open-amp Commit: 4d412df37f25cd28fa21b9614eaf37ee69df3f53 https://github.com/OpenAMP/open-amp/commit/4d412df37f25cd28fa21b9614eaf37ee6... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths: M lib/include/openamp/remoteproc_virtio.h M lib/remoteproc/remoteproc.c M lib/remoteproc/remoteproc_virtio.c
Log Message: ----------- remoteproc: Validate virtqueue alignment
The remote resource table controls the vring alignment, which is used for pointer rounding without validation. vring_init() rounds the used ring address with a ~(align - 1) mask, so a zero alignment leaves a NULL used ring that is dereferenced later.
Reject a zero alignment before calculating the vring size and before storing the vring metadata taken from the resource table.
Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5
Commit: 22ddff1a4ec37f40e4785c65ea632404af8413a5 https://github.com/OpenAMP/open-amp/commit/22ddff1a4ec37f40e4785c65ea632404a... Author: Ben Levinsky ben.levinsky@amd.com Date: 2026-09-22 (Tue, 22 Sep 2026)
Changed paths: M lib/remoteproc/rsc_table_parser.c
Log Message: ----------- remoteproc: Validate resource table entry bounds
Resource offsets from a copied firmware table are dereferenced without bounds checks when no I/O region is present. Handlers can then access memory beyond the table through a VDEV's flexible vring array.
Reject a NULL table, validate offset-array arithmetic, and require every entry to remain inside the table before dispatch. Check fixed sizes, VDEV vrings and config data, and vendor lengths using overflow-safe subtraction.
Signed-off-by: Ben Levinsky ben.levinsky@amd.com Assisted-by: Codex:GPT-5
Compare: https://github.com/OpenAMP/open-amp/compare/d0e5e0d376a3...22ddff1a4ec3
To unsubscribe from these emails, change your notification settings at https://github.com/OpenAMP/open-amp/settings/notifications