[PATCH 2/2] memory: brcmstb_dpfe: Bounds check DCPU-supplied MSG_ARG_COUNT

[Florian Fainelli]

On 8/26/26 13:14, Danesh Petigara wrote:
> From: Justin Chen <justin.chen at broadcom.com>
> 
> A compromised or buggy DCPU coprocessor can make any user who reads
> world-readable /sys/devices/.../dpfe_info|dpfe_dram trigger a kernel
> stack out-of-bounds read of arbitrary extent. This bounds checks
> chksum_idx against MSG_FIELD_MAX after reading the response from DCPU
> message RAM.
> 
> Fixes: 5d06f53d9509 ("memory: brcmstb: dpfe: Compute checksum at __send_command() time")
> Cc: stable at vger.kernel.org
> Signed-off-by: Justin Chen <justin.chen at broadcom.com>
> Assisted-by: Gemini:gemini-3.1-pro-preview cursor
> Signed-off-by: Danesh Petigara <danesh.petigara at broadcom.com>

Reviewed-by: Florian Fainelli <florian.fainelli at broadcom.com>
-- 
Florian