Skip to content
Snippets Groups Projects
user avatar
Ram Prakash Gupta authored
Buffer allocated in sequential files are used by firmware loader,
when no vendor firmware path is used, firmware uploader is modifying
the memory in the redzone.

=============================================================================
BUG kmalloc-4k (Tainted: G        W  OE     ): Left Redzone overwritten
-----------------------------------------------------------------------------
0xffffff8854ae0fff-0xffffff8854ae0fff @offset=4095. First byte 0x0
instead of 0xcc
Allocated in kvmalloc_node+0x194/0x2b4 age=10 cpu=2 pid=4758
__kmem_cache_alloc_node+0x2a8/0x388
__kmalloc_node+0x60/0x1e0
kvmalloc_node+0x194/0x2b4
seq_read_iter+0x8c/0x4f0
kernfs_fop_read_iter+0x70/0x1ec
vfs_read+0x238/0x2d8
ksys_read+0x78/0xe8
__arm64_sys_read+0x1c/0x2c
invoke_syscall+0x58/0x114
el0_svc_common+0xac/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x3c/0x74
el0t_64_sync_handler+0x68/0xbc
el0t_64_sync+0x1a8/0x1ac

Freed in kfree_link+0x10/0x20 age=46 cpu=1 pid=4786
__kmem_cache_free+0x268/0x358
kfree+0xa0/0x168
kfree_link+0x10/0x20
walk_component+0x90/0x128
link_path_walk+0x27c/0x3cc
path_openat+0x94/0xc7c
do_filp_open+0xb8/0x164
do_sys_openat2+0x84/0xf0
__arm64_sys_openat+0x70/0x9c
invoke_syscall+0x58/0x114
el0_svc_common+0xac/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x3c/0x74
el0t_64_sync_handler+0x68/0xbc
el0t_64_sync+0x1a8/0x1ac

Redzone  ffffff8854ae0ff0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 00
                                                       redzone modified ^^
Object   ffffff8854ae1000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Add check to avoid memory update in redzone when no vendor firmware path
is used.

Fixes: 2a46f357 ("ANDROID: firmware_loader: Add support for customer firmware paths")
Bug: 395517985
Change-Id: If58a44c0c8a26f3fe58b0e37b0fcc1f0e88e28cb
Signed-off-by: default avatarRam Prakash Gupta <quic_rampraka@quicinc.com>
Signed-off-by: default avatarSouradeep Chowdhury <quic_schowdhu@quicinc.com>
fe163fe3