From 2629a2e2f1930029298dd12f996f7397b4f261d3 Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" Date: Thu, 2 Apr 2020 12:04:35 -0700 Subject: [PATCH 1/2] haven: Fix NULL pointer dereference in hh_rm_populate_mem_attr_desc() Use the locally calculated value of memory attribute entries when populating the memory attribute descriptor, instead of always dereferencing the client provided memory attribute descriptor, as clients may not always provide one. Change-Id: Ifbe586336e69e439ed404067616cce7515fd7953 Signed-off-by: Isaac J. Manjarres --- drivers/virt/haven/hh_rm_iface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/virt/haven/hh_rm_iface.c b/drivers/virt/haven/hh_rm_iface.c index 625e48518647..c7c88c03b98c 100644 --- a/drivers/virt/haven/hh_rm_iface.c +++ b/drivers/virt/haven/hh_rm_iface.c @@ -609,7 +609,7 @@ static void hh_rm_populate_mem_attr_desc(struct hh_mem_attr_desc *dst_desc, { u32 n_mem_attr_entries = src_desc ? src_desc->n_mem_attr_entries : 0; - dst_desc->n_mem_attr_entries = src_desc->n_mem_attr_entries; + dst_desc->n_mem_attr_entries = n_mem_attr_entries; if (n_mem_attr_entries) memcpy(dst_desc->attr_entries, src_desc->attr_entries, sizeof(*dst_desc->attr_entries) * n_mem_attr_entries); From 7b0b276d760147c38553d0015ce3a9fe13841b18 Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" Date: Thu, 2 Apr 2020 10:22:14 -0700 Subject: [PATCH 2/2] haven: Fix buffer calculations for MEM_SHARE and MEM_LEND The logic for calculating the request buffer sizes for the MEM_SHARE and MEM_LEND resource manager calls is not present, so add it. Change-Id: I804ee108565733b0e4b376b5fd31abdb3d359c1f Signed-off-by: Isaac J. Manjarres --- drivers/virt/haven/hh_rm_iface.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/virt/haven/hh_rm_iface.c b/drivers/virt/haven/hh_rm_iface.c index c7c88c03b98c..4d155bf971fc 100644 --- a/drivers/virt/haven/hh_rm_iface.c +++ b/drivers/virt/haven/hh_rm_iface.c @@ -629,6 +629,10 @@ static void hh_rm_populate_mem_request(void *req_buf, u32 fn_id, u32 n_sgl_entries = src_sgl_desc ? src_sgl_desc->n_sgl_entries : 0; switch (fn_id) { + case HH_RM_RPC_MSG_ID_CALL_MEM_LEND: + case HH_RM_RPC_MSG_ID_CALL_MEM_SHARE: + req_hdr_size = sizeof(struct hh_mem_share_req_payload_hdr); + break; case HH_RM_RPC_MSG_ID_CALL_MEM_QCOM_LOOKUP_SGL: req_hdr_size = sizeof(struct hh_mem_qcom_lookup_sgl_req_payload_hdr); @@ -663,6 +667,10 @@ static void *hh_rm_alloc_mem_request_buf(u32 fn_id, size_t n_acl_entries, switch (fn_id) { + case HH_RM_RPC_MSG_ID_CALL_MEM_LEND: + case HH_RM_RPC_MSG_ID_CALL_MEM_SHARE: + req_payload_size = sizeof(struct hh_mem_share_req_payload_hdr); + break; case HH_RM_RPC_MSG_ID_CALL_MEM_QCOM_LOOKUP_SGL: req_payload_size = sizeof(struct hh_mem_qcom_lookup_sgl_req_payload_hdr);