A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

remoteproc: qcom: mdt_loader: Use signed type for offset

Browse source 
In the transition from using rproc_da_to_va(), the type of the load
offset became unsigned. This causes the subsequent check to let negative
values less than p_memsz + mem_size through and we write outside of the
buffer.

Change the type back to a signed value to catch this.

Fixes: 7f0dd07a9b ("remoteproc: qcom: mdt_loader: Refactor MDT loader")
Fixes: e7fd252262 ("remoteproc: qcom: q6v5: Decouple driver from MDT loader")
Reported-by: Dan Carpenter <[email protected]>
Reported-by: Stanimir Varbanov <[email protected]>
Acked-by: Andy Gross <[email protected]>
Signed-off-by: Bjorn Andersson <[email protected]>
This commit is contained in:
Bjorn Andersson 2017-02-15 14:00:41 -08:00
commit 01625cc5e6
2 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
drivers/soc/qcom/mdt_loader.c
View file

@ -98,7 +98,7 @@ int qcom_mdt_load(struct device *dev, const struct firmware *fw,
phys_addr_t min_addr = (phys_addr_t)ULLONG_MAX;
phys_addr_t max_addr = 0;
size_t fw_name_len;
size_t offset;
ssize_t offset;
char *fw_name;
bool relocate = false;
void *ptr;