Re: [PATCH v3 2/4] soc: qcom: smem: validate private entry list walks

[Konrad Dybcio]

On 9/24/26 3:10 PM, Albert Esteve wrote:
> From: Sarannya S <quic_sarannya@xxxxxxxxxxxxxxxx>
> 
> When walking private entries, use the uncached/cached free offsets as
> the list bounds, require room for a header before dereferencing, and
> reject a next pointer that does not advance.
> 
> Skip the cached list when the cached free offset is at the partition
> end.
> 
> Signed-off-by: Sarannya S <quic_sarannya@xxxxxxxxxxxxxxxx>
> Signed-off-by: Pranav Mahesh Phansalkar <quic_pphansal@xxxxxxxxxxxxxxxx>
> Signed-off-by: Sudeepgoud Patil <quic_sudeepgo@xxxxxxxxxxxxxxxx>
> Signed-off-by: Albert Esteve <aesteve@xxxxxxxxxx>
> ---

[...]

> -	while (hdr < end) {
> +	while ((hdr + 1) < end) {

This will reject a header that's at the tail of the buffer, need
to make this <= instead

[...]

> -	while (e < end) {
> +	while ((e + 1) < uncached_end) {

Likewise

[...]

> -		e = cached_entry_next(e, part->cacheline);
> +		next_e = cached_entry_next(e, part->cacheline);
> +		if (WARN_ON(next_e >= e))
> +			return ERR_PTR(-EINVAL);
> +
> +		e = next_e;
>  	}
>  
>  	if (WARN_ON((void *)e < (void *)phdr))

And LLM thinks should compare against cached_end

Konrad