A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina

Browse source 
"LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0"

* tag 'LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
  bus: mhi: Fix potential out-of-bound access
  rpmsg: slatecom: maintain rx_size to read
  rpmsg: slatecom: out of bound read from process_cmd
  soc: qcom: add out of bound check for AON fifo
  soc: qcom: smem: Add boundary checks for partitions
  msm: kgsl: Do not release dma and anon buffers if unmap fails
  msm: kgsl: Do not release dma and anon buffers if unmap fails
  memshare: Prevent possible integer overflow
  msm: kgsl: Keep the timeline fence valid for logging
  msm: ipa: Add support for Private IP Forwarding
  msm: ipa3: add support to identify wifi attach
  soc: qcom: minidump_log: Protect md_dump_slabinfo under SLUB_DEBUG
  mm: slub: Declare slab_owner_ops only when SLUB DEBUG is enabled
  soc: qcom: Add BLAIR-LITE SoC information to socinfo
  soc: qcom: socinfo: Add soc information for BLAIR LTE
  msm_serial_hs: Fix race between mod_timer and del_timer calls

Change-Id: I5ab9a7732af0be4754b506f2c815ab29b236fb91
This commit is contained in:
Michael Bestas 2024-03-23 17:36:59 +02:00
commit 58d91073d9
No known key found for this signature in database
GPG key ID: CC95044519BE6669
15 changed files with 173 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

17
drivers/rpmsg/qcom_glink_slatecom.c
View file

@ -1900,7 +1900,7 @@ static void glink_slatecom_handle_rx_done(struct glink_slatecom *glink,
mutex_unlock(&channel->intent_lock);
}
static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_data,
static int glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_data,
u32 rx_size)
{
struct glink_slatecom_msg *msg;
@ -1909,12 +1909,18 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
unsigned int param3;
unsigned int param4;
unsigned int cmd;
int offset = 0;
int ret;
u32 offset = 0;
int ret = 0;
u16 name_len;
char *name;
while (offset < rx_size) {
if (rx_size - offset < sizeof(struct glink_slatecom_msg)) {
ret = -EBADMSG;
GLINK_ERR(glink, "%s: Error %d process cmd\n", __func__, ret);
return ret;
}
msg = (struct glink_slatecom_msg *)(rx_data + offset);
offset += sizeof(*msg);
@ -1935,7 +1941,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
case SLATECOM_CMD_CLOSE_ACK:
glink_slatecom_rx_defer(glink,
rx_data + offset - sizeof(*msg),
rx_size + offset - sizeof(*msg), 0);
rx_size - offset + sizeof(*msg), 0);
break;
case SLATECOM_CMD_RX_INTENT_REQ:
glink_slatecom_handle_intent_req(glink, param1, param2);
@ -1948,7 +1954,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
name = rx_data + offset;
glink_slatecom_rx_defer(glink,
rx_data + offset - sizeof(*msg),
rx_size + offset - sizeof(*msg),
rx_size - offset + sizeof(*msg),
ALIGN(name_len, SLATECOM_ALIGNMENT));
offset += ALIGN(name_len, SLATECOM_ALIGNMENT);
@ -1997,6 +2003,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
break;
}
}
return ret;
}
/**