A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

dsp: adsp-loader: Add check around bytes read from nvmem cell

Browse source 
nvmem_cell_read() return no of bytes read in 'len' variable and
allocates similiar bytes of memory for buffer. Copy only these
number of bytes from buf to avoid out of bounds issues.

Change-Id: I712e5058d15deba939b6a743fcf5bff33ac51f84
Signed-off-by: Ajit Pandey <ajitp@codeaurora.org>
This commit is contained in:
Ajit Pandey 2019-11-06 11:42:42 +05:30
commit 2d71d6d099
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
dsp/adsp-loader.c
View file

@ -324,14 +324,14 @@ static int adsp_loader_probe(struct platform_device *pdev)
{
struct adsp_loader_private *priv = NULL;
struct nvmem_cell *cell;
ssize_t len;
size_t len;
u32 *buf;
const char **adsp_fw_name_array = NULL;
int adsp_fw_cnt;
u32* adsp_fw_bit_values = NULL;
int i;
int fw_name_size;
u32 adsp_var_idx;
u32 adsp_var_idx = 0;
int ret = 0;
ret = adsp_loader_init_sysfs(pdev);
@ -349,11 +349,11 @@ static int adsp_loader_probe(struct platform_device *pdev)
}
buf = nvmem_cell_read(cell, &len);
nvmem_cell_put(cell);
if (IS_ERR_OR_NULL(buf)) {
if (IS_ERR_OR_NULL(buf) || len <= 0 || len > sizeof(u32)) {
dev_dbg(&pdev->dev, "%s: FAILED to read nvmem cell \n", __func__);
goto wqueue;
}
adsp_var_idx = (*buf);
memcpy(&adsp_var_idx, buf, len);
kfree(buf);
/* Get count of fw images */