A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 11:41:38 -04:00
Code Issues Projects Releases Packages Wiki Activity

remoteproc: qcom: mdt_loader: Use signed type for offset

Browse source 
In the transition from using rproc_da_to_va(), the type of the load
offset became unsigned. This causes the subsequent check to let negative
values less than p_memsz + mem_size through and we write outside of the
buffer.

Change the type back to a signed value to catch this.

Fixes: 7f0dd07a9b ("remoteproc: qcom: mdt_loader: Refactor MDT loader")
Fixes: e7fd252262 ("remoteproc: qcom: q6v5: Decouple driver from MDT loader")
Reported-by: Dan Carpenter <[email protected]>
Reported-by: Stanimir Varbanov <[email protected]>
Acked-by: Andy Gross <[email protected]>
Signed-off-by: Bjorn Andersson <[email protected]>
This commit is contained in:
Bjorn Andersson 2017-02-15 14:00:41 -08:00
commit 01625cc5e6
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/remoteproc/qcom_q6v5_pil.c
View file

@ -502,7 +502,7 @@ static int q6v5_mpss_load(struct q6v5 *qproc)
phys_addr_t max_addr = 0;
bool relocate = false;
char seg_name[10];
size_t offset;
ssize_t offset;
size_t size;
void *ptr;
int ret;