On Mon, Dec 30, 2024 at 08:59:35PM +0100, Stephan Gerhold wrote:
> On MSM8916 devices, the serial number exposed in sysfs is constant and does
> not change across individual devices. It's always:
>
> db410c:/sys/devices/soc0$ cat serial_number
> 2644893864
>
> The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not
> have support for the serial_num field in the socinfo struct. There is an
> existing check to avoid exposing the serial number in that case, but it's
> not correct: When checking the item_size returned by SMEM, we need to make
> sure the *end* of the serial_num is within bounds, instead of comparing
> with the *start* offset. The serial_number currently exposed on MSM8916
> devices is just an out of bounds read of whatever comes after the socinfo
> struct in SMEM.
>
> Fix this by changing offsetof() to offsetofend(), so that the size of the
> field is also taken into account.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver")
> Signed-off-by: Stephan Gerhold <stephan.gerhold@xxxxxxxxxx>
> ---
> drivers/soc/qcom/socinfo.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@xxxxxxxxxx>
--
With best wishes
Dmitry
