diff options
Diffstat (limited to 'drivers/soc')
-rw-r--r-- | drivers/soc/qcom/mdt_loader.c | 17 | ||||
-rw-r--r-- | drivers/soc/qcom/pdr_interface.c | 2 | ||||
-rw-r--r-- | drivers/soc/qcom/wcnss_ctrl.c | 15 |
3 files changed, 28 insertions, 6 deletions
diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c index 24cd193dec55..eba7f76f9d61 100644 --- a/drivers/soc/qcom/mdt_loader.c +++ b/drivers/soc/qcom/mdt_loader.c @@ -230,6 +230,14 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, break; } + if (phdr->p_filesz > phdr->p_memsz) { + dev_err(dev, + "refusing to load segment %d with p_filesz > p_memsz\n", + i); + ret = -EINVAL; + break; + } + ptr = mem_region + offset; if (phdr->p_filesz && phdr->p_offset < fw->size) { @@ -253,6 +261,15 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, break; } + if (seg_fw->size != phdr->p_filesz) { + dev_err(dev, + "failed to load segment %d from truncated file %s\n", + i, fw_name); + release_firmware(seg_fw); + ret = -EINVAL; + break; + } + release_firmware(seg_fw); } diff --git a/drivers/soc/qcom/pdr_interface.c b/drivers/soc/qcom/pdr_interface.c index 209dcdca923f..915d5bc3d46e 100644 --- a/drivers/soc/qcom/pdr_interface.c +++ b/drivers/soc/qcom/pdr_interface.c @@ -153,7 +153,7 @@ static int pdr_register_listener(struct pdr_handle *pdr, if (resp.resp.result != QMI_RESULT_SUCCESS_V01) { pr_err("PDR: %s register listener failed: 0x%x\n", pds->service_path, resp.resp.error); - return ret; + return -EREMOTEIO; } pds->state = resp.curr_state; diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c index 32bed249f90e..2a06d631e415 100644 --- a/drivers/soc/qcom/wcnss_ctrl.c +++ b/drivers/soc/qcom/wcnss_ctrl.c @@ -199,6 +199,8 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) { struct wcnss_download_nv_req *req; const struct firmware *fw; + struct device *dev = wcnss->dev; + const char *nvbin = NVBIN_FILE; const void *data; ssize_t left; int ret; @@ -207,10 +209,13 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) if (!req) return -ENOMEM; - ret = request_firmware(&fw, NVBIN_FILE, wcnss->dev); + ret = of_property_read_string(dev->of_node, "firmware-name", &nvbin); + if (ret < 0 && ret != -EINVAL) + goto free_req; + + ret = request_firmware(&fw, nvbin, dev); if (ret < 0) { - dev_err(wcnss->dev, "Failed to load nv file %s: %d\n", - NVBIN_FILE, ret); + dev_err(dev, "Failed to load nv file %s: %d\n", nvbin, ret); goto free_req; } @@ -235,7 +240,7 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) ret = rpmsg_send(wcnss->channel, req, req->hdr.len); if (ret < 0) { - dev_err(wcnss->dev, "failed to send smd packet\n"); + dev_err(dev, "failed to send smd packet\n"); goto release_fw; } @@ -248,7 +253,7 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) ret = wait_for_completion_timeout(&wcnss->ack, WCNSS_REQUEST_TIMEOUT); if (!ret) { - dev_err(wcnss->dev, "timeout waiting for nv upload ack\n"); + dev_err(dev, "timeout waiting for nv upload ack\n"); ret = -ETIMEDOUT; } else { *expect_cbc = wcnss->ack_status == WCNSS_ACK_COLD_BOOTING; |