]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
remoteproc: qcom: Fix minidump out-of-bounds access on subsystems array
authorMukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Tue, 31 Mar 2026 17:12:43 +0000 (22:42 +0530)
committerBjorn Andersson <andersson@kernel.org>
Mon, 6 Apr 2026 14:44:12 +0000 (09:44 -0500)
commit743cfae79d2458e241b06ed523c28a09f1449b75
tree9bbf5d83e7d192bef58546af1e46b59a5c8b6d95
parent479ba9d293f5fa32cfd2a14a502690eca769e5ee
remoteproc: qcom: Fix minidump out-of-bounds access on subsystems array

MAX_NUM_OF_SS was hardcoded to 10 in the minidump_global_toc struct,
which is a direct overlay on an SMEM item allocated by the firmware.
Newer Qualcomm SoC firmware allocates space for more subsystems, while
older firmware only allocates space for 10. Bumping the constant would
cause Linux to read/write beyond the SMEM item boundary on older
platforms.

Fix this by converting subsystems[] to a flexible array member and
deriving the actual number of subsystems at runtime from the size
returned by qcom_smem_get(). Add a bounds check on minidump_id against
the derived count before indexing into the array.

Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260331171243.1962067-1-mukesh.ojha@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
drivers/remoteproc/qcom_common.c