msm: pil: Replace incorrect offset check
This check is practically useless as it doesn't ensure anything
besides that the program headers start within the file size. It's
still possible for the program headers to extend beyond the size
of the data passed in. Fix this check by actually ensuring the
size of the buffer is enough to contain at least the program
headers so we don't access unmapped memory.
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
diff --git a/arch/arm/mach-msm/peripheral-loader.c b/arch/arm/mach-msm/peripheral-loader.c
index 68d3235..03d6fc2 100644
--- a/arch/arm/mach-msm/peripheral-loader.c
+++ b/arch/arm/mach-msm/peripheral-loader.c
@@ -178,8 +178,9 @@
ret = -EIO;
goto release_fw;
}
- if (ehdr->e_phoff > fw->size) {
- dev_err(&pil->pdev.dev, "Program header beyond size of mdt\n");
+ if (sizeof(struct elf32_phdr) * ehdr->e_phnum +
+ sizeof(struct elf32_hdr) > fw->size) {
+ dev_err(&pil->pdev.dev, "Program headers not within mdt\n");
ret = -EIO;
goto release_fw;
}