A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'sm8350/lineage-20' into lineage-22.2

Browse source 
* sm8350/lineage-20:
  qcacmn: Fix OOB Read in util_gen_new_ie
  BACKPORT: dsp-kernel: Add attribute and flag checks during map creation

Change-Id: I1257311e97442a66141ce387ab8c718d50ae0058
This commit is contained in:
Michael Bestas 2025-04-08 18:34:24 +03:00
commit 102fb409d0
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/char/adsprpc.c
View file

@ -1443,6 +1443,12 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
goto bail;
}
} else if (mflags == FASTRPC_DMAHANDLE_NOMAP) {
if (map->attr & FASTRPC_ATTR_KEEP_MAP) {
ADSPRPC_ERR("Invalid attribute 0x%x for fd %d\n",
map->attr, fd);
err = -EINVAL;
goto bail;
}
VERIFY(err, !IS_ERR_OR_NULL(map->buf = dma_buf_get(fd)));
if (err) {
ADSPRPC_ERR("dma_buf_get failed for fd %d ret %ld\n",

2
drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -2167,7 +2167,7 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen,
if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP ||
tmp_new[0] == WLAN_ELEMID_SSID ||
tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX ||
((tmp_new[0] == WLAN_ELEMID_EXTN_ELEM) &&
((tmp_new[0] == WLAN_ELEMID_EXTN_ELEM) && tmp_new[1] &&
(tmp_new[2] == WLAN_EXTN_ELEMID_NONINHERITANCE)))) {
if ((pos + tmp_new[1] + MIN_IE_LEN) <=
(new_ie + ielen)) {