The outbound SMEM item has a fixed array of SMP2P_MAX_ENTRY (16) entries, thus driver should be sure that DTB does not have more of these, otherwise such incorrect DTB would cause out-of-bounds writes. Reported-by: Sashiko Closes: https://sashiko.dev/#/bug/linux-eaf9beb4-cc0d-4d8e-be28-4c12b039b3c8 Fixes: 50e99641413e ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski --- drivers/soc/qcom/smp2p.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c index 7c1684c65e3b..784a164cf367 100644 --- a/drivers/soc/qcom/smp2p.c +++ b/drivers/soc/qcom/smp2p.c @@ -517,6 +517,11 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, struct smp2p_smem_item *out = smp2p->out; char buf[SMP2P_MAX_ENTRY_NAME] = {}; + if (out->valid_entries >= SMP2P_MAX_ENTRY) { + dev_err(smp2p->dev, "too many outbound entries\n"); + return -EINVAL; + } + /* Allocate an entry from the smem item */ strscpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME); memcpy(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME); -- 2.53.0