Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9872707b authored by Amir Samuelov's avatar Amir Samuelov
Browse files

soc: qcom: spss_utils: fix SPU SSR during IAR-sw-update 



Fix buffer overflow on memcpy().
memcpy size of u32 on bool variable.
memcpy() to "is_ssr_disabled" overwrites "is_iar_active" to zero.

Change-Id: If7b9ca9149feb54a37fbb0eef7300fa8021d4e54
Signed-off-by: default avatarAmir Samuelov <amirs@codeaurora.org>
parent e0e663e3

drivers/soc/qcom/spss_utils.c

+10 −2
Original line number Diff line number Diff line
@@ -581,10 +581,17 @@ static long spss_utils_ioctl(struct file *file, 
		}



		if (is_iar_active) {

			memcpy(&is_ssr_disabled, data, size);

			pr_debug("SSR disabled state updated to: %d\n",

			uint32_t tmp = 0;



			memcpy(&tmp, data, sizeof(tmp));

			is_ssr_disabled = (bool) tmp; /* u32 to bool */



			pr_info("SSR disabled state updated to: %d\n",

				 is_ssr_disabled);

		}



		pr_info("is_iar_active [%d] is_ssr_disabled [%d].\n",

			is_iar_active, is_ssr_disabled);

		break;



	default:
@@ -1200,6 +1207,7 @@ static int spss_probe(struct platform_device *pdev) 
	}

	mutex_init(&event_lock);



	is_iar_active = false;

	is_ssr_disabled = false;



	pr_info("Probe completed successfully, [%s].\n", firmware_name);