From: Johan Hovold <johan+linaro@kernel.org>
To: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>,
Amol Maheshwari <amahesh@qti.qualcomm.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Arnd Bergmann <arnd@arndb.de>,
Bjorn Andersson <andersson@kernel.org>,
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>,
linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
Johan Hovold <johan+linaro@kernel.org>
Subject: [PATCH 0/3] misc: fastrpc: fix memory corruption
Date: Mon, 29 Aug 2022 10:05:28 +0200 [thread overview]
Message-ID: <20220829080531.29681-1-johan+linaro@kernel.org> (raw)
The fastrpc driver uses a fixed-sized array to store its sessions but
missing and broken sanity checks could lead to memory beyond the array
being corrupted.
This specifically happens on SC8280XP platforms that use 14 sessions for
the compute DSP.
These are all needed for 6.0.
Johan
Johan Hovold (3):
misc: fastrpc: fix memory corruption on probe
misc: fastrpc: fix memory corruption on open
misc: fastrpc: increase maximum session count
drivers/misc/fastrpc.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--
2.35.1
next reply other threads:[~2022-08-29 8:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-29 8:05 Johan Hovold [this message]
2022-08-29 8:05 ` [PATCH 1/3] misc: fastrpc: fix memory corruption on probe Johan Hovold
2022-08-29 8:05 ` [PATCH 2/3] misc: fastrpc: fix memory corruption on open Johan Hovold
2022-08-29 8:05 ` [PATCH 3/3] misc: fastrpc: increase maximum session count Johan Hovold
2022-09-02 10:02 ` [PATCH 0/3] misc: fastrpc: fix memory corruption Srinivas Kandagatla
2022-09-02 12:28 ` Johan Hovold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220829080531.29681-1-johan+linaro@kernel.org \
--to=johan+linaro@kernel.org \
--cc=amahesh@qti.qualcomm.com \
--cc=andersson@kernel.org \
--cc=arnd@arndb.de \
--cc=gregkh@linuxfoundation.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=manivannan.sadhasivam@linaro.org \
--cc=srinivas.kandagatla@linaro.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox