From patchwork Mon Aug 29 08:05:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 601943 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73F22C3DA6B for ; Mon, 29 Aug 2022 08:06:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229817AbiH2IGu (ORCPT ); Mon, 29 Aug 2022 04:06:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229776AbiH2IGs (ORCPT ); Mon, 29 Aug 2022 04:06:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC9C252838; Mon, 29 Aug 2022 01:06:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E8F3EB80D63; Mon, 29 Aug 2022 08:06:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8B999C43470; Mon, 29 Aug 2022 08:06:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1661760404; bh=vEVlgcvzHAGVREWl4JAo7TyUTWO2ajtrlaWpFndzrc0=; h=From:To:Cc:Subject:Date:From; b=S7iMWIDWo1Xza4W8WqTIfQiJg96PtyaAoQVcHlTa2Vf8jrMQssWnueb2urKUULkCA kvZoNKbnAEroXKk3hFkwAYeUkW36/RX327Z39MQ+1zKYWG2KEDY2N4m7pLJ2Ag9Awh 1U/JZG6ao/FYetkUx9/Pv4sBeH8Fu/YCzudUcwLjYCMTkEVb4X3RYaoGH6MFvbYYH8 D+0pkwF4K9lhrF/Yx6R2hrLbpIy8sUV/A2Xd3vPmeXQpIEGxV7YE4T6j5CNH/iYhOC glnZVwVG0tRqdAg+xQn5a5FqnTOfgiR+h8L1FN5nT3wdMaX8YmL3AFr9Kc3WiZWf0U Gw6ZKd2rgcELg== Received: from johan by xi.lan with local (Exim 4.94.2) (envelope-from ) id 1oSZnH-0007jS-V2; Mon, 29 Aug 2022 10:06:51 +0200 From: Johan Hovold To: Srinivas Kandagatla , Amol Maheshwari Cc: Greg Kroah-Hartman , Arnd Bergmann , Bjorn Andersson , Manivannan Sadhasivam , linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH 0/3] misc: fastrpc: fix memory corruption Date: Mon, 29 Aug 2022 10:05:28 +0200 Message-Id: <20220829080531.29681-1-johan+linaro@kernel.org> X-Mailer: git-send-email 2.35.1 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-arm-msm@vger.kernel.org The fastrpc driver uses a fixed-sized array to store its sessions but missing and broken sanity checks could lead to memory beyond the array being corrupted. This specifically happens on SC8280XP platforms that use 14 sessions for the compute DSP. These are all needed for 6.0. Johan Johan Hovold (3): misc: fastrpc: fix memory corruption on probe misc: fastrpc: fix memory corruption on open misc: fastrpc: increase maximum session count drivers/misc/fastrpc.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)