remoteproc: qcom: mdt_loader: Use signed type for offset
In the transition from using rproc_da_to_va(), the type of the load offset became unsigned. This causes the subsequent check to let negative values less than p_memsz + mem_size through and we write outside of the buffer. Change the type back to a signed value to catch this. Fixes:7f0dd07a9b
("remoteproc: qcom: mdt_loader: Refactor MDT loader") Fixes:e7fd252262
("remoteproc: qcom: q6v5: Decouple driver from MDT loader") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Reported-by: Stanimir Varbanov <stanimir.varbanov@linaro.org> Acked-by: Andy Gross <andy.gross@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
This commit is contained in:
parent
231c8dfd1a
commit
01625cc5e6
|
@ -502,7 +502,7 @@ static int q6v5_mpss_load(struct q6v5 *qproc)
|
||||||
phys_addr_t max_addr = 0;
|
phys_addr_t max_addr = 0;
|
||||||
bool relocate = false;
|
bool relocate = false;
|
||||||
char seg_name[10];
|
char seg_name[10];
|
||||||
size_t offset;
|
ssize_t offset;
|
||||||
size_t size;
|
size_t size;
|
||||||
void *ptr;
|
void *ptr;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
|
@ -98,7 +98,7 @@ int qcom_mdt_load(struct device *dev, const struct firmware *fw,
|
||||||
phys_addr_t min_addr = (phys_addr_t)ULLONG_MAX;
|
phys_addr_t min_addr = (phys_addr_t)ULLONG_MAX;
|
||||||
phys_addr_t max_addr = 0;
|
phys_addr_t max_addr = 0;
|
||||||
size_t fw_name_len;
|
size_t fw_name_len;
|
||||||
size_t offset;
|
ssize_t offset;
|
||||||
char *fw_name;
|
char *fw_name;
|
||||||
bool relocate = false;
|
bool relocate = false;
|
||||||
void *ptr;
|
void *ptr;
|
||||||
|
|
Loading…
Reference in New Issue