Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d5f729cb authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "qseecom: Fix stack out of bounds issue"

parents 0554b510 0e6ee3c9

drivers/misc/qseecom.c

+12 −4
Original line number Diff line number Diff line
@@ -647,7 +647,9 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, 
			if (!tzbuf)

				return -ENOMEM;

			memset(tzbuf, 0, tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t), tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t),

				(sizeof(struct qseecom_key_generate_ireq) -

				sizeof(uint32_t)));

			dmac_flush_range(tzbuf, tzbuf + tzbuflen);

			smc_id = TZ_OS_KS_GEN_KEY_ID;

			desc.arginfo = TZ_OS_KS_GEN_KEY_ID_PARAM_ID;
@@ -669,7 +671,9 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, 
				return -ENOMEM;

			}

			memset(tzbuf, 0, tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t), tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t),

				(sizeof(struct qseecom_key_delete_ireq) -

				sizeof(uint32_t)));

			dmac_flush_range(tzbuf, tzbuf + tzbuflen);

			smc_id = TZ_OS_KS_DEL_KEY_ID;

			desc.arginfo = TZ_OS_KS_DEL_KEY_ID_PARAM_ID;
@@ -691,7 +695,9 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, 
				return -ENOMEM;

			}

			memset(tzbuf, 0, tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t), tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t),

				(sizeof(struct qseecom_key_select_ireq) -

				sizeof(uint32_t)));

			dmac_flush_range(tzbuf, tzbuf + tzbuflen);

			smc_id = TZ_OS_KS_SET_PIPE_KEY_ID;

			desc.arginfo = TZ_OS_KS_SET_PIPE_KEY_ID_PARAM_ID;
@@ -713,7 +719,9 @@ static int qseecom_scm_call2(uint32_t svc_id, uint32_t tz_cmd_id, 
				return -ENOMEM;

			}

			memset(tzbuf, 0, tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t), tzbuflen);

			memcpy(tzbuf, req_buf + sizeof(uint32_t), (sizeof

				(struct qseecom_key_userinfo_update_ireq) -

				sizeof(uint32_t)));

			dmac_flush_range(tzbuf, tzbuf + tzbuflen);

			smc_id = TZ_OS_KS_UPDATE_KEY_ID;

			desc.arginfo = TZ_OS_KS_UPDATE_KEY_ID_PARAM_ID;