The Qualcomm SMEM driver manages shared memory partitions used for
inter-processor communication on Qualcomm SoCs, including the
automotive SA8775P platform. Vendor trees carry additional validation
and partition-enumeration logic that is not yet present in master.
Patch 1 adds IN_PARTITION_RANGE() for pointer+size checks against a region.
Patch 2 adds bounds checks when walking private uncached and cached
entry lists.
Patch 3 validates item payload size and pointer once a matching entry is
found.
Patch 4 skips multi-remote-host partitions during enumeration. SMEM
now supports partitions involving more than one remote host, but the
driver does not implement that case yet.
The first three patches split the original vendor boundary-check change
so each class of condition can be reviewed on its own. All four are
based on public vendor patches from Qualcomm [1][2]. Adapted for
master. In particular:
- Dropped the xarray partition rework, which is already present in
master (79602b750b96c, "soc: qcom: smem: Switch partitions to
xarray")
Built on master (Linux 7.3-rc4), and tested (prior to rebase, with
Linux 7.2.0-rc6+) on Qualcomm SA8775P Ride V3 board. SMEM platform device
binds and initializes successfully.
[1] https://git.codelinaro.org/clo/la/kernel/qcom/-/commit/3e521f2641c8f01f00fd74a088206942ce23d6d4
[2] https://git.codelinaro.org/clo/la/kernel/qcom/-/commit/842dd28b0276b3824a607e067b3c20e266bcf230
Signed-off-by: Albert Esteve <aesteve@redhat.com>
---
Changes in v3:
- Rebased to v7.3-rc4
- Split the overflow/boundary patch into helper, list-walk, and payload
validation patches
- Fixed qcom_smem_get_private() while loop condition
- Fixed indentations
- Link to v2: https://lore.kernel.org/r/20260904-port-smem-v2-0-bb497dd3c48b@redhat.com
Changes in v2:
- Update patch 1 authorship to Sarannya
- Update all emails from @quicinc.com to @oss.qualcomm.com
- Make smem.c copyright yearless
- Link to v1: https://lore.kernel.org/r/20260820-port-smem-v1-0-d19a45f583bf@redhat.com
---
Sarannya S (3):
soc: qcom: smem: add IN_PARTITION_RANGE helper
soc: qcom: smem: validate private entry list walks
soc: qcom: smem: validate private item payloads
Tony Truong (1):
soc: qcom: smem: ignore multi remote host partitions
drivers/soc/qcom/smem.c | 107 ++++++++++++++++++++++++++++++++++--------------
1 file changed, 76 insertions(+), 31 deletions(-)
---
base-commit: 62f4c998b297cf233997a2b4cd6fc2d2df0319c9
change-id: 20260819-port-smem-7518c77c9415
Best regards,
--
Albert Esteve <aesteve@redhat.com>