Evolution-X-Devices/kernel_nothing_sm7325
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

haven: hh_rm_core: Change datatype of num_fragments

Browse Source 
Integer overflow can occur for a large value of req_buff_size because
num_fragments is declared as u8. Declare it as int in order to prevent
this from occurring.

Change-Id: I9e3655af13134ec57d123317ebb7b287a7470a19
Signed-off-by: Guru Das Srinagesh <gurus@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
This commit is contained in:
Guru Das Srinagesh
2021-08-24 13:03:51 -07:00
committed by Gerrit - the friendly Code Review server
parent 3b06ec126c
commit dd473e6c28
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/virt/haven/hh_rm_core.c
View File

@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2021, The Linux Foundation. All rights reserved.
*
*/
@@ -485,7 +485,7 @@ static int hh_rm_send_request(u32 message_id,
const void *req_buff_curr = req_buff;
struct hh_rm_rpc_hdr *hdr;
unsigned long tx_flags;
u8 num_fragments = 0;
u32 num_fragments = 0;
size_t payload_size;
void *send_buff;
int i, ret;