anierin/msm-5.15
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

soc: qcom: add buffer overflow check on AON rx_buffer

Browse Source 
Add buffer overflow check while accessing data buffer
received from AON.

Change-Id: I0472a0ad1e6edc3fe8102850fddacd89ceea4959
Signed-off-by: Praveen koya <quic_pkoya@quicinc.com>
This commit is contained in:
Praveen koya
2023-05-30 14:47:21 +05:30
parent 15b63b2c0d
commit 8a271e2bbc
3 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/soc/qcom/slate_events_bridge.c
View File

@@ -596,6 +596,10 @@ void seb_rx_msg(void *data, int len)
wake_up(&dev->link_state_wait);
if (dev->wait_for_resp) {
if (len > SEB_GLINK_INTENT_SIZE) {
pr_err("Invalid seb rx buffer length\n");
return;
}
memcpy(dev->rx_buf, data, len);
} else {
/* Handle the event received from Slate */

4
drivers/soc/qcom/slate_rsb.c
View File

@@ -151,6 +151,10 @@ void slatersb_rx_msg(void *data, int len)
struct slatersb_priv *dev =
container_of(slatersb_drv, struct slatersb_priv, lhndl);
if (len > SLATERSB_GLINK_INTENT_SIZE) {
pr_err("Invalid slatersb glink intent size\n");
return;
}
dev->slate_resp_cmplt = true;
wake_up(&dev->link_state_wait);
memcpy(dev->rx_buf, data, len);

7
drivers/soc/qcom/slatecom_interface.c
View File

@@ -52,6 +52,7 @@
#define __QAPI_VERSION_MAJOR_MASK (0xff000000)
#define __QAPI_VERSION_MINOR_MASK (0x00ff0000)
#define __QAPI_VERSION_NIT_MASK (0x0000ffff)
#define SCOM_GLINK_INTENT_SIZE 308
/*pil_slate_intf.h*/
#define RESULT_SUCCESS 0
@@ -121,7 +122,7 @@ struct slatedaemon_priv {
bool slate_resp_cmplt;
void *lhndl;
wait_queue_head_t link_state_wait;
char rx_buf[308];
char rx_buf[SCOM_GLINK_INTENT_SIZE];
struct work_struct slatecom_up_work;
struct work_struct slatecom_down_work;
struct mutex glink_mutex;
@@ -226,6 +227,10 @@ void slatecom_rx_msg(void *data, int len)
struct slatedaemon_priv *dev =
container_of(slatecom_intf_drv, struct slatedaemon_priv, lhndl);
if (len > SCOM_GLINK_INTENT_SIZE) {
pr_err("Invalid slatecom_intf glink intent size\n");
return;
}
dev->slate_resp_cmplt = true;
wake_up(&dev->link_state_wait);
memcpy(dev->rx_buf, data, len);