Commit 190b216c authored by Alex Elder's avatar Alex Elder Committed by Andy Gross
Browse files

soc: qcom: smem: verify partition header size 



Add verification in qcom_smem_partition_header() that the size in a
partition's header structure matches the size in its partition table
entry.

Signed-off-by: default avatarAlex Elder <elder@linaro.org>
Signed-off-by: default avatarAndy Gross <andy.gross@linaro.org>
parent ada79289

drivers/soc/qcom/smem.c

+8 −11
Original line number Diff line number Diff line
@@ -733,6 +733,7 @@ qcom_smem_partition_header(struct qcom_smem *smem, 
		struct smem_ptable_entry *entry)

{

	struct smem_partition_header *header;

	u32 size;



	header = smem->regions[0].virt_base + le32_to_cpu(entry->offset);
@@ -743,6 +744,13 @@ qcom_smem_partition_header(struct qcom_smem *smem, 
		return NULL;

	}



	size = le32_to_cpu(header->size);

	if (size != le32_to_cpu(entry->size)) {

		dev_err(smem->dev, "bad partition size (%u != %u)\n",

			size, le32_to_cpu(entry->size));

		return NULL;

	}



	return header;

}
@@ -796,11 +804,6 @@ static int qcom_smem_set_global_partition(struct qcom_smem *smem) 
		return -EINVAL;

	}



	if (le32_to_cpu(header->size) != le32_to_cpu(entry->size)) {

		dev_err(smem->dev, "Global partition has invalid size\n");

		return -EINVAL;

	}



	size = le32_to_cpu(header->offset_free_uncached);

	if (size > le32_to_cpu(header->size)) {

		dev_err(smem->dev,
@@ -871,12 +874,6 @@ static int qcom_smem_enumerate_partitions(struct qcom_smem *smem, 
			return -EINVAL;

		}



		if (le32_to_cpu(header->size) != le32_to_cpu(entry->size)) {

			dev_err(smem->dev,

				"Partition %d has invalid size\n", i);

			return -EINVAL;

		}



		if (le32_to_cpu(header->offset_free_uncached) > le32_to_cpu(header->size)) {

			dev_err(smem->dev,

				"Partition %d has invalid free pointer\n", i);