From 0106549bb994956320ed766f687edde09bd2a2c3 Mon Sep 17 00:00:00 2001 From: Kaushal Hooda Date: Fri, 2 Jun 2023 20:21:06 +0530 Subject: [PATCH] rpmsg: slatecom: out of bound read from process_cmd When dereferencing "rx_data" as type "glink_slatecom_msg" , we didn't check if "rx_data" has enough room to hold that type. The "rx_size" is read from slate to master fifo and if received rx_size is less then "glink_slatecom_msg" then it could lead to heap out of bounds read. If received rx_size is less then the expected glink_slatecom_msg then return back as a bad message. Change-Id: Idde757ee70c7c88c22e4f036e6da0280e3b385d0 Signed-off-by: Kaushal Hooda (cherry picked from commit 7ddb61a6ac27c795177021b05f60377482043222) --- drivers/rpmsg/qcom_glink_slatecom.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/rpmsg/qcom_glink_slatecom.c b/drivers/rpmsg/qcom_glink_slatecom.c index d57adfa3c92f..18ae3934aa15 100644 --- a/drivers/rpmsg/qcom_glink_slatecom.c +++ b/drivers/rpmsg/qcom_glink_slatecom.c @@ -1900,7 +1900,7 @@ static void glink_slatecom_handle_rx_done(struct glink_slatecom *glink, mutex_unlock(&channel->intent_lock); } -static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_data, +static int glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_data, u32 rx_size) { struct glink_slatecom_msg *msg; @@ -1909,12 +1909,18 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da unsigned int param3; unsigned int param4; unsigned int cmd; - int offset = 0; - int ret; + u32 offset = 0; + int ret = 0; u16 name_len; char *name; while (offset < rx_size) { + if (rx_size - offset < sizeof(struct glink_slatecom_msg)) { + ret = -EBADMSG; + GLINK_ERR(glink, "%s: Error %d process cmd\n", __func__, ret); + return ret; + } + msg = (struct glink_slatecom_msg *)(rx_data + offset); offset += sizeof(*msg); @@ -1997,6 +2003,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da break; } } + return ret; } /**