From nobody Sat Sep 26 04:31:06 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D0ED4CA773 for ; Fri, 4 Sep 2026 15:19:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535148; cv=none; b=rNSkq7betVWqyYKYjwRbnUpbEqXyLNZLaPxaWFF1fk9FvWikev1mvBm9NJEQ5xPlJ666yFHpp4//Cdggd0HRryZW2exEM4vVsG57n7MbnqIjrZv5DnK5dzpuVDJYvtzNWDP2nUhm99yZMGOQUzBbEuuEfX1M1J91l9QpLF/ePNE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535148; c=relaxed/simple; bh=fIRKV/9jKTj7ZenVzMXZQuiEqbFTgVDfH8IIci9CrcQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ZCgg8dZbW8lgJuPw5Je447GanOmwqtP/9o/te08kSsrqmbFV/GnAfB6Tgt3kbxZ9vK0wGf+cSrwQZifQ0wenEySf0Jx0lmwEqSq2KA23p0k8gR6WzUEdLPVcH+lM4iGiIOr05yX7DkrDIB+HNL1A7v1/z/hIN6K0Q/uNlBVUulA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=C0Dd/k1v; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="C0Dd/k1v" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788535146; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Eiciw+/kcrwHSElZlsk1HKoJc4yowLrlZSajNPrw00o=; b=C0Dd/k1v4V4ofFudhK1kJd9t48ubJdw/jvwmiJ692eCvuXk1FiRId7F3YjTiLfwvQhaBLG cYEa+h0HkM2qrbf266lWbCJC7gY4poZNbmEXaIf9sedCc+oO/l+bkpjgCqtnodReja9R+v qnzXHe1Ajhs3NpwSf2MH88Fu22GEKxA= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-148-pP3N96zqPCGAheYPZgmRJw-1; Fri, 04 Sep 2026 11:19:01 -0400 X-MC-Unique: pP3N96zqPCGAheYPZgmRJw-1 X-Mimecast-MFC-AGG-ID: pP3N96zqPCGAheYPZgmRJw_1788535138 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DF9F019114A9; Fri, 4 Sep 2026 15:18:57 +0000 (UTC) Received: from aesteve-thinkpadp1gen8.rmtes.csb (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id E54EE18005AD; Fri, 4 Sep 2026 15:18:55 +0000 (UTC) From: Albert Esteve Date: Fri, 04 Sep 2026 17:18:47 +0200 Subject: [PATCH v2 1/2] soc: qcom: smem: add boundary checks for partitions Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-port-smem-v2-1-bb497dd3c48b@redhat.com> References: <20260904-port-smem-v2-0-bb497dd3c48b@redhat.com> In-Reply-To: <20260904-port-smem-v2-0-bb497dd3c48b@redhat.com> To: Bjorn Andersson , Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Albert Esteve , Sarannya S , Pranav Mahesh Phansalkar , Sudeepgoud Patil X-Developer-Signature: v=1; a=ed25519-sha256; t=1788535133; l=6651; i=aesteve@redhat.com; s=20260827; h=from:subject:message-id; bh=0rGL6zHSFvXqGwCXA9EegJvGUsNITbDuSHNJIYU326I=; b=02Y3QWDfbUk0Y1C4Mcyax/U1KqFhWk4X/gd3nIYoLXdkqjdj11g36hFqEj0F3hl8lwyNxvMey Y5yTfe6RQzOBPI5R2fhPjpy0gp0iyFUCBx2kRfVWDj1yigKlL33mY3P X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=zI2RBeZgocwYm3AkJW4CtjoJnKoDZrfBl1xe5Ed6h+U= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 From: Sarannya S Add condition check to make sure that the end address of private entry does not go out of partition. Signed-off-by: Sarannya S Signed-off-by: Pranav Mahesh Phansalkar Signed-off-by: Sudeepgoud Patil Signed-off-by: Albert Esteve --- drivers/soc/qcom/smem.c | 105 +++++++++++++++++++++++++++++++++-----------= ---- 1 file changed, 72 insertions(+), 33 deletions(-) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index b5e7bd8c1512..1456ff6df293 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -2,6 +2,7 @@ /* * Copyright (c) 2015, Sony Mobile Communications AB. * Copyright (c) 2012-2013, The Linux Foundation. All rights reserved. + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ =20 #include @@ -88,6 +89,17 @@ /* Processor/host identifier for the global partition */ #define SMEM_GLOBAL_HOST 0xfffe =20 +/* Entry range check + * ptr >=3D start : Checks if ptr is greater than the start of access regi= on + * ptr + size >=3D ptr: Check for integer overflow (On 32bit system where = ptr + * and size are 32bits, ptr + size can wrap around to be a small integer) + * ptr + size <=3D end: Checks if ptr+size is less than the end of access = region + */ +#define IN_PARTITION_RANGE(ptr, size, start, end) \ + (((void *)(ptr) >=3D (void *)(start)) && \ + (((void *)(ptr) + (size)) >=3D (void *)(ptr)) && \ + (((void *)(ptr) + (size)) <=3D (void *)(end))) + /** * struct smem_proc_comm - proc_comm communication struct (legacy) * @command: current command to be executed @@ -409,6 +421,7 @@ static int qcom_smem_alloc_private(struct qcom_smem *sm= em, size_t size) { struct smem_private_entry *hdr, *end; + struct smem_private_entry *next_hdr; struct smem_partition_header *phdr; size_t alloc_size; void *cached; @@ -421,19 +434,25 @@ static int qcom_smem_alloc_private(struct qcom_smem *= smem, end =3D phdr_to_last_uncached_entry(phdr); cached =3D phdr_to_last_cached_entry(phdr); =20 - if (WARN_ON((void *)end > p_end || cached > p_end)) + if (WARN_ON(!IN_PARTITION_RANGE(end, 0, phdr, cached) || + cached > p_end)) return -EINVAL; =20 - while (hdr < end) { + while ((hdr < end) && ((hdr + 1) < end)) { if (hdr->canary !=3D SMEM_PRIVATE_CANARY) goto bad_canary; if (le16_to_cpu(hdr->item) =3D=3D item) return -EEXIST; =20 - hdr =3D uncached_entry_next(hdr); + next_hdr =3D uncached_entry_next(hdr); + + if (WARN_ON(next_hdr <=3D hdr)) + return -EINVAL; + + hdr =3D next_hdr; } =20 - if (WARN_ON((void *)hdr > p_end)) + if (WARN_ON((void *)hdr > (void *)end)) return -EINVAL; =20 /* Check that we don't grow into the cached region */ @@ -592,9 +611,11 @@ static void *qcom_smem_get_private(struct qcom_smem *s= mem, unsigned int item, size_t *size) { - struct smem_private_entry *e, *end; + struct smem_private_entry *e, *uncached_end, *cached_end; + struct smem_private_entry *next_e; struct smem_partition_header *phdr; void *item_ptr, *p_end; + size_t entry_size =3D 0; u32 padding_data; u32 e_size; =20 @@ -602,67 +623,85 @@ static void *qcom_smem_get_private(struct qcom_smem *= smem, p_end =3D (void *)phdr + part->size; =20 e =3D phdr_to_first_uncached_entry(phdr); - end =3D phdr_to_last_uncached_entry(phdr); + uncached_end =3D phdr_to_last_uncached_entry(phdr); + cached_end =3D phdr_to_last_cached_entry(phdr); + + if (WARN_ON(!IN_PARTITION_RANGE(uncached_end, 0, phdr, cached_end) + || (void *)cached_end > p_end)) + return ERR_PTR(-EINVAL); =20 - while (e < end) { + while ((e < uncached_end) && ((e + 1) < uncached_end)) { if (e->canary !=3D SMEM_PRIVATE_CANARY) goto invalid_canary; =20 if (le16_to_cpu(e->item) =3D=3D item) { - if (size !=3D NULL) { - e_size =3D le32_to_cpu(e->size); - padding_data =3D le16_to_cpu(e->padding_data); + e_size =3D le32_to_cpu(e->size); + padding_data =3D le16_to_cpu(e->padding_data); =20 - if (WARN_ON(e_size > part->size || padding_data > e_size)) - return ERR_PTR(-EINVAL); + if (e_size < part->size && padding_data < e_size) + entry_size =3D e_size - padding_data; + else + return ERR_PTR(-EINVAL); =20 - *size =3D e_size - padding_data; - } + item_ptr =3D uncached_entry_to_item(e); =20 - item_ptr =3D uncached_entry_to_item(e); - if (WARN_ON(item_ptr > p_end)) + if (WARN_ON(!IN_PARTITION_RANGE(item_ptr, entry_size, e, uncached_end))) return ERR_PTR(-EINVAL); =20 + if (size !=3D NULL) + *size =3D entry_size; + return item_ptr; } =20 - e =3D uncached_entry_next(e); - } + next_e =3D uncached_entry_next(e); + if (WARN_ON(next_e <=3D e)) + return ERR_PTR(-EINVAL); =20 - if (WARN_ON((void *)e > p_end)) + e =3D next_e; + } + if (WARN_ON((void *)e > (void *)uncached_end)) return ERR_PTR(-EINVAL); =20 /* Item was not found in the uncached list, search the cached list */ =20 + if (cached_end =3D=3D p_end) + return ERR_PTR(-ENOENT); + e =3D phdr_to_first_cached_entry(phdr, part->cacheline); - end =3D phdr_to_last_cached_entry(phdr); =20 - if (WARN_ON((void *)e < (void *)phdr || (void *)end > p_end)) + if (WARN_ON(!IN_PARTITION_RANGE(cached_end, 0, uncached_end, p_end) || + !IN_PARTITION_RANGE(e, sizeof(*e), cached_end, p_end))) return ERR_PTR(-EINVAL); =20 - while (e > end) { + while (e > cached_end) { if (e->canary !=3D SMEM_PRIVATE_CANARY) goto invalid_canary; =20 if (le16_to_cpu(e->item) =3D=3D item) { - if (size !=3D NULL) { - e_size =3D le32_to_cpu(e->size); - padding_data =3D le16_to_cpu(e->padding_data); + e_size =3D le32_to_cpu(e->size); + padding_data =3D le16_to_cpu(e->padding_data); =20 - if (WARN_ON(e_size > part->size || padding_data > e_size)) - return ERR_PTR(-EINVAL); - - *size =3D e_size - padding_data; - } + if (e_size < part->size && padding_data < e_size) + entry_size =3D e_size - padding_data; + else + return ERR_PTR(-EINVAL); =20 - item_ptr =3D cached_entry_to_item(e); - if (WARN_ON(item_ptr < (void *)phdr)) + item_ptr =3D cached_entry_to_item(e); + if (WARN_ON(!IN_PARTITION_RANGE(item_ptr, entry_size, cached_end, e))) return ERR_PTR(-EINVAL); =20 + if (size !=3D NULL) + *size =3D entry_size; + return item_ptr; } =20 - e =3D cached_entry_next(e, part->cacheline); + next_e =3D cached_entry_next(e, part->cacheline); + if (WARN_ON(next_e >=3D e)) + return ERR_PTR(-EINVAL); + + e =3D next_e; } =20 if (WARN_ON((void *)e < (void *)phdr)) --=20 2.55.0 From nobody Sat Sep 26 04:31:06 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC3FA4EC646 for ; Fri, 4 Sep 2026 15:19:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535154; cv=none; b=fNkUdEyhv7ZVkALnP3yFGjLhK+Mtp8kTLPPfKvEAmtvmvjBPmgJUbtCfkqTUsgLtkKX3t9hF1++2rKf3oHvCT9Xoo0q3F7e4IJ956f7x3zcSnxONHzdyc+SU0VcYmdAeVuJgt9Yj//UgRgcQSp2WBbXrFYDCD6CVhNHGstRWm0o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788535154; c=relaxed/simple; bh=YZazT4oZjVEcdtqEOh2rjHMVg3XbWfyLZ1BTcqpcZJ8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=YwNZyib74g3VCjg8EqKzrj8RwjK7zho6Q9QvRUnBb0DKgMlpdEDztHjc1JsHEic4pXmy0p/O93pC2hO7uF0vMejNCLaJ//WJlaanaWdaVY1j72y24sow8RvyxwOk6SBGn27efTmynNDF+2DCVZGFmrNt35SxEjKvmq8XOXH6lSY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=HZ/uOW64; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="HZ/uOW64" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1788535151; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=B4EvanRHS6J3ohripixRgJnTJuSPOhK6F9EanOjwirY=; b=HZ/uOW647RDJfKp4NyiLaNFqkCBB5OhnywR1T1Cx5+XXpyrW4FoZHSQjPcMQoxZpo9Yre/ kUF79hFKBtCFzOEdEUlky6BShH9ZE+jChd5oRq2VBbLlFvU7F8T6U+bqi0HQhkRWePjJPp mpNd/1ngaYBAJeFrfCH1p/XWULh/8sE= Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-44-Qcwl6sO1PkynxBkbeiipeQ-1; Fri, 04 Sep 2026 11:19:03 -0400 X-MC-Unique: Qcwl6sO1PkynxBkbeiipeQ-1 X-Mimecast-MFC-AGG-ID: Qcwl6sO1PkynxBkbeiipeQ_1788535139 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 89EEA195FE03; Fri, 4 Sep 2026 15:18:59 +0000 (UTC) Received: from aesteve-thinkpadp1gen8.rmtes.csb (headnet04.pony-001.prod.iad2.dc.redhat.com [10.2.32.116]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3F1F118005B2; Fri, 4 Sep 2026 15:18:58 +0000 (UTC) From: Albert Esteve Date: Fri, 04 Sep 2026 17:18:48 +0200 Subject: [PATCH v2 2/2] soc: qcom: smem: ignore multi remote host partitions Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-port-smem-v2-2-bb497dd3c48b@redhat.com> References: <20260904-port-smem-v2-0-bb497dd3c48b@redhat.com> In-Reply-To: <20260904-port-smem-v2-0-bb497dd3c48b@redhat.com> To: Bjorn Andersson , Konrad Dybcio Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, Albert Esteve , Tony Truong X-Developer-Signature: v=1; a=ed25519-sha256; t=1788535133; l=1296; i=aesteve@redhat.com; s=20260827; h=from:subject:message-id; bh=cdDVa0xgpM9uyB7LE+x2F1bNpsmjlD7ehAPULbKbtP8=; b=o68sOhK8wCTeNniQDA2swgYAbvu/N9nqEpA5HWuIRWAoHdLHVEpRjpQyCVHR/lzIlImAXUHAC 9yeErdQ+B9iDuLigCCi+vZvK2YKtPI/cIvzhFb49ALOeCc0JMcU/jS2 X-Developer-Key: i=aesteve@redhat.com; a=ed25519; pk=zI2RBeZgocwYm3AkJW4CtjoJnKoDZrfBl1xe5Ed6h+U= X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 From: Tony Truong SMEM now supports more than just 1-to-1 partitions. It is possible for a partition to have multiple remote host and the logic to handle that does not exist. For now, skip all partitions which has multiple remote hosts. Signed-off-by: Tony Truong Signed-off-by: Albert Esteve Reviewed-by: Konrad Dybcio --- drivers/soc/qcom/smem.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c index 1456ff6df293..6c59eef6015e 100644 --- a/drivers/soc/qcom/smem.c +++ b/drivers/soc/qcom/smem.c @@ -89,6 +89,9 @@ /* Processor/host identifier for the global partition */ #define SMEM_GLOBAL_HOST 0xfffe =20 +/* Processor/host identifier for multi host partition */ +#define SMEM_MULTI_HOST 0xfffc + /* Entry range check * ptr >=3D start : Checks if ptr is greater than the start of access regi= on * ptr + size >=3D ptr: Check for integer overflow (On 32bit system where = ptr @@ -1091,6 +1094,9 @@ qcom_smem_enumerate_partitions(struct qcom_smem *smem= , u16 local_host) else continue; =20 + if (remote_host =3D=3D SMEM_MULTI_HOST) + continue; + if (xa_load(&smem->partitions, remote_host)) { dev_err(smem->dev, "duplicate host %u\n", remote_host); return -EINVAL; --=20 2.55.0