From cc1b31a0b94e06fe522ef8e78c9d3559df34cd9a Mon Sep 17 00:00:00 2001 From: Neeraj Upadhyay Date: Mon, 12 Oct 2020 09:45:39 +0530 Subject: [PATCH] soc: qcom: Fix memcpy operations in ramdump_read Currently, for device memory addresses, which are not aligned on 8 byte boundary, ramdump_read() copies the bytes till the start of next aligned address. However, this calculation does not take into account the case, where copy_size is less that the number of bytes till next alignment. This causes memcpy to copy device memory to region, which is outside of the allocated buffer. Fix this by copying only the copy_size buffer for this case. Change-Id: I918ab5886d664f89c0eebd99972f5b9960e1ae00 Signed-off-by: Neeraj Upadhyay --- drivers/soc/qcom/ramdump.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/qcom/ramdump.c b/drivers/soc/qcom/ramdump.c index 7aeb2913a2e2..e0b81f27a976 100644 --- a/drivers/soc/qcom/ramdump.c +++ b/drivers/soc/qcom/ramdump.c @@ -236,6 +236,8 @@ static ssize_t ramdump_read(struct file *filep, char __user *buf, size_t count, if ((unsigned long)device_mem & 0x7) { bytes_before = 8 - ((unsigned long)device_mem & 0x7); + bytes_before = min_t(unsigned long, (unsigned long)copy_size, + bytes_before); memcpy_fromio(alignbuf, device_mem, bytes_before); device_mem += bytes_before; alignbuf += bytes_before;