fsa_user_info.gpios[] is a fixed 20-element array, but the number of
descriptors iterated and indexed comes from the FSA add-on board EEPROM:
board_info.sockgpios and board_info.ioexpgpios are u8 fields (up to 255
each) read via dm_i2c_read() with no upper bound.
fsa_config_gpios(), invoked automatically at boot from fsa_init(), loops
over info->gpios[i] for i < sockgpios + ioexpgpios, reading past the
20-element array (an out-of-bounds stack read whose contents are then
used to configure GPIOs and build names). do_fsa_gpio() validates the
console-supplied index only against the same EEPROM counts, so
"fsa gpio <i> ..." can memcpy() a descriptor to user_info.gpios[i] for i
up to 254 -- an out-of-bounds stack write that is then written back to
the EEPROM.
A malicious or swapped FSA add-on board EEPROM (only a valid checksum is
required, which the attacker can compute) thus yields OOB accesses on the
boot path and via the console command.
Clamp the descriptor count to ARRAY_SIZE(info->gpios) before iterating,
and reject any console index outside the array.
Fixes: da9e2218af ("board: venice: add FSA support")
Signed-off-by: Christopher Kleiner <chris@kleiner.pro>
Christopher KleinerandFabio Estevam
ce5793d777