diff options
| author | Zhenhua Huang <zhenhuah@codeaurora.org> | 2018-09-06 14:27:14 +0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-09-13 19:43:51 -0700 |
| commit | 371698455ce0a5015be109174ec65366e4064d28 (patch) | |
| tree | c17d829747fc9f68b44dd4cdfcba75592c9aa8e9 /drivers/soc/qcom/secure_buffer.c | |
| parent | dffb51fe96bd2130002f8ca891845f94e5fe494c (diff) | |
soc: qcom: secure_buffer: Fix the parameter passing to dmac_flush_range
For "chunk_list + chunk_list_len", if the chunk_list is type of u32*,
the chunk_list_len will be 4 * of original size. So we flushed a wrong
area size. In some condition like we enabled CONFIG_DEBUG_PAGEALLOC, it
may flush out of page bound of the invalid pte page.
Fix it by manually convert it as void* when doing the addition.
CRs-Fixed: 2309993
Change-Id: I2b88d78ba73d9904fa2bf6106937001715b6037f
Signed-off-by: Zhenhua Huang <zhenhuah@codeaurora.org>
Diffstat (limited to 'drivers/soc/qcom/secure_buffer.c')
| -rw-r--r-- | drivers/soc/qcom/secure_buffer.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/soc/qcom/secure_buffer.c b/drivers/soc/qcom/secure_buffer.c index 38ccc62a8484..59341ebf5e72 100644 --- a/drivers/soc/qcom/secure_buffer.c +++ b/drivers/soc/qcom/secure_buffer.c @@ -1,6 +1,6 @@ /* * Copyright (C) 2011 Google, Inc - * Copyright (c) 2011-2017, The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2018, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -144,7 +144,8 @@ static int secure_buffer_change_table(struct sg_table *table, int lock) * secure environment to ensure the data is actually present * in RAM */ - dmac_flush_range(chunk_list, chunk_list + chunk_list_len); + dmac_flush_range(chunk_list, + (void *)chunk_list + chunk_list_len); ret = secure_buffer_change_chunk(virt_to_phys(chunk_list), nchunks, V2_CHUNK_SIZE, lock); |