From 9872707b31e54980e51a162312d8f8626c85c051 Mon Sep 17 00:00:00 2001 From: Amir Samuelov Date: Mon, 12 Oct 2020 10:13:52 +0300 Subject: [PATCH] soc: qcom: spss_utils: fix SPU SSR during IAR-sw-update Fix buffer overflow on memcpy(). memcpy size of u32 on bool variable. memcpy() to "is_ssr_disabled" overwrites "is_iar_active" to zero. Change-Id: If7b9ca9149feb54a37fbb0eef7300fa8021d4e54 Signed-off-by: Amir Samuelov --- drivers/soc/qcom/spss_utils.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/spss_utils.c b/drivers/soc/qcom/spss_utils.c index edc8c6a89c90..c94c1a2df953 100644 --- a/drivers/soc/qcom/spss_utils.c +++ b/drivers/soc/qcom/spss_utils.c @@ -581,10 +581,17 @@ static long spss_utils_ioctl(struct file *file, } if (is_iar_active) { - memcpy(&is_ssr_disabled, data, size); - pr_debug("SSR disabled state updated to: %d\n", + uint32_t tmp = 0; + + memcpy(&tmp, data, sizeof(tmp)); + is_ssr_disabled = (bool) tmp; /* u32 to bool */ + + pr_info("SSR disabled state updated to: %d\n", is_ssr_disabled); } + + pr_info("is_iar_active [%d] is_ssr_disabled [%d].\n", + is_iar_active, is_ssr_disabled); break; default: @@ -1200,6 +1207,7 @@ static int spss_probe(struct platform_device *pdev) } mutex_init(&event_lock); + is_iar_active = false; is_ssr_disabled = false; pr_info("Probe completed successfully, [%s].\n", firmware_name);