What the developer wrote
Authored by tychovrahe
fix(core): fix dma2d syscall verifiers
[no changelog]
What changed, and why it matters
This commit fixes a potential integer overflow bug in the Trezor hardware wallet's kernel syscall verifier. The verifier checks whether a graphics operation's source or destination memory region is accessible before allowing it. Previously, the multiplication of stride (row byte length) by height (number of rows) was done using the original integer types, which could overflow and produce a smaller value than the actual memory region size. That could let a malicious or buggy userspace app pass the access check while reading or writing memory outside its allowed area. The fix forces the multiplication to use size_t, a wider type, so the calculated region size is accurate on 32-bit STM32 hardware.
Treat this as a security-relevant kernel hardening fix. Review related syscall verifiers for similar integer-width issues, ensure probe_*_access helpers correctly handle size_t inputs, and consider whether other graphics or DMA syscalls perform size arithmetic without widening. If a security advisory is issued, note the integer-overflow bypass of access checks.
Security signals we found
Integer overflow in memory-size calculation at kernel syscall boundary
Insufficient bounds check before DMA2D/bitblt memory access
Potential read/write access violation bypass in userspace-to-kernel syscall verifier
Fix uses explicit size_t widening to prevent overflow
Evidence from the diff
In core/embed/sys/syscall/stm32/syscall_verifiers.c, the CHECK_BB_DST and CHECK_BB_SRC macros compute the byte size of a 2D blit region as dst_stride * height and src_stride * height. Before the patch, these operands retained their original (likely narrower) integer types, making the multiplication susceptible to integer overflow. An overflow would yield a smaller size than the real buffer, causing probe_write_access/probe_read_access to validate only a subset of the memory actually touched by the DMA2D/bitblt operation. The patch casts both operands to size_t before multiplying, widening the arithmetic and preventing overflow on 32-bit platforms. This is a kernel/userspace boundary issue in the syscall verifier for the STM32 embedded kernel.
Changed components
core/embed/sys/syscall/stm32/syscall_verifiers.cDMA2D / bitblt syscall verifiersKernel/userspace memory access probes on STM32 Trezor devicesInspect captured patch +6 / −5
diff --git a/core/embed/sys/syscall/stm32/syscall_verifiers.c b/core/embed/sys/syscall/stm32/syscall_verifiers.c
index a8d30581..d8b00677 100644
--- a/core/embed/sys/syscall/stm32/syscall_verifiers.c
+++ b/core/embed/sys/syscall/stm32/syscall_verifiers.c
@@ -31,15 +31,16 @@
#ifdef KERNEL
// Checks if bitblt destination is accessible
-#define CHECK_BB_DST(_bb) \
- if (!probe_write_access((_bb)->dst_row, \
- (_bb)->dst_stride * (_bb)->height)) { \
- goto access_violation; \
+#define CHECK_BB_DST(_bb) \
+ if (!probe_write_access((_bb)->dst_row, (size_t)(_bb)->dst_stride * \
+ (size_t)(_bb)->height)) { \
+ goto access_violation; \
}
// Checks if bitblt source is accessible
#define CHECK_BB_SRC(_bb) \
- if (!probe_read_access((_bb)->src_row, (_bb)->src_stride * (_bb)->height)) { \
+ if (!probe_read_access((_bb)->src_row, \
+ (size_t)(_bb)->src_stride * (size_t)(_bb)->height)) { \
goto access_violation; \
}
Why this scored 64/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.