Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ba4aef73 authored by Raghavendra Rao Ananta's avatar Raghavendra Rao Ananta
Browse files

soc: qcom: socinfo: Fix array out-of-bounds access 



Socinfo driver's socinfo_get_id_string() does an array based
indexing with the socid to get the entry for the current
platform in soc_id[]. However, the soc_id[] is linearly
mapped and not arranged to be indexed with the socid (unlike
previous targets). This would cause an out-of-bounds array
access in the soc_id[] array.

Hence to fetch the name, rely on the already existing function,
socinfo_machine(), which would iterate over the array and
return a matching machine name for the id supplied.

Change-Id: Ib7070732ac4ec99a32eb3f79c74abf2903398f53
Signed-off-by: default avatarRaghavendra Rao Ananta <rananta@codeaurora.org>
parent 00cda3c5

drivers/soc/qcom/socinfo.c

+13 −13
Original line number Diff line number Diff line
@@ -1163,6 +1163,18 @@ static void socinfo_print(void) 
	}

}



static const char *socinfo_machine(unsigned int id)

{

	int idx;



	for (idx = 0; idx < ARRAY_SIZE(soc_id); idx++) {

		if (soc_id[idx].id == id)

			return soc_id[idx].name;

	}



	return NULL;

}



uint32_t socinfo_get_id(void)

{

	return (socinfo) ? le32_to_cpu(socinfo->id) : 0;
@@ -1173,22 +1185,10 @@ const char *socinfo_get_id_string(void) 
{

	uint32_t id = socinfo_get_id();



	return (socinfo) ? soc_id[id].name : NULL;

	return socinfo_machine(id);

}

EXPORT_SYMBOL(socinfo_get_id_string);



static const char *socinfo_machine(unsigned int id)

{

	int idx;



	for (idx = 0; idx < ARRAY_SIZE(soc_id); idx++) {

		if (soc_id[idx].id == id)

			return soc_id[idx].name;

	}



	return NULL;

}



static int qcom_socinfo_probe(struct platform_device *pdev)

{

	struct qcom_socinfo *qs;