The SMP2P SMEM item has limited space for outbound entries, but the DT can specify any number of entries. Add a check to prevent out of bounds writes when an invalid DT specifies more entries than expected. Fixes: 50e99641413e ("soc: qcom: smp2p: Qualcomm Shared Memory Point to Point") Signed-off-by: Stephan Gerhold Signed-off-by: Abel Vesa --- drivers/soc/qcom/smp2p.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c index 1ea4d35c6..876648d0b 100644 --- a/drivers/soc/qcom/smp2p.c +++ b/drivers/soc/qcom/smp2p.c @@ -441,6 +441,9 @@ static int qcom_smp2p_outbound_entry(struct qcom_smp2p *smp2p, struct smp2p_smem_item *out = smp2p->out; char buf[SMP2P_MAX_ENTRY_NAME] = {}; + if (out->valid_entries == out->total_entries) + return -ENOMEM; + /* Allocate an entry from the smem item */ strscpy(buf, entry->name, SMP2P_MAX_ENTRY_NAME); memcpy(out->entries[out->valid_entries].name, buf, SMP2P_MAX_ENTRY_NAME);