From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Elder Subject: [PATCH 08/12] soc: qcom: smem: verify partition header size Date: Tue, 1 May 2018 20:10:15 -0500 Message-ID: <20180502011019.22812-9-elder@linaro.org> References: <20180502011019.22812-1-elder@linaro.org> Return-path: In-Reply-To: <20180502011019.22812-1-elder@linaro.org> Sender: linux-kernel-owner@vger.kernel.org To: andy.gross@linaro.org Cc: clew@codeaurora.org, aneela@codeaurora.org, david.brown@linaro.org, linux-arm-msm@vger.kernel.org, linux-soc@vger.kernel.org, linux-kernel@vger.kernel.org List-Id: linux-arm-msm@vger.kernel.org Add verification in qcom_smem_partition_header() that the size in a partition's header structure matches the size in its partition table entry. Signed-off-by: Alex Elder --- drivers/soc/qcom/smem.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index d52a282f7338..f1e6e4609ccb 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -737,6 +737,7 @@ qcom_smem_partition_header(struct qcom_smem *smem, struct smem_ptable_entry *entry) { struct smem_partition_header *header; + u32 size; header = smem->regions[0].virt_base + le32_to_cpu(entry->offset); @@ -747,6 +748,13 @@ qcom_smem_partition_header(struct qcom_smem *smem, return NULL; } + size = le32_to_cpu(header->size); + if (size != le32_to_cpu(entry->size)) { + dev_err(smem->dev, "bad partition size (%u != %u)\n", + size, le32_to_cpu(entry->size)); + return NULL; + } + return header; } @@ -795,11 +803,6 @@ static int qcom_smem_set_global_partition(struct qcom_smem *smem) return -EINVAL; } - if (le32_to_cpu(header->size) != le32_to_cpu(entry->size)) { - dev_err(smem->dev, "Global partition has invalid size\n"); - return -EINVAL; - } - size = le32_to_cpu(header->offset_free_uncached); if (size > le32_to_cpu(header->size)) { dev_err(smem->dev, @@ -868,12 +871,6 @@ static int qcom_smem_enumerate_partitions(struct qcom_smem *smem, return -EINVAL; } - if (le32_to_cpu(header->size) != le32_to_cpu(entry->size)) { - dev_err(smem->dev, - "Partition %d has invalid size\n", i); - return -EINVAL; - } - if (le32_to_cpu(header->offset_free_uncached) > le32_to_cpu(header->size)) { dev_err(smem->dev, "Partition %d has invalid free pointer\n", i); -- 2.14.1