A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 20:33:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

rpmsg: slatecom: maintain rx_size to read

Browse source 
For cmd close_ack or open request where rx_size is being
incrementing with respect to offset might lead to out of
bound read from rx_data.

Decrease rx_size as we process commands.

Change-Id: I492eadcbebb78386fc20f744eb9ad8db4a2914fc
Signed-off-by: Kaushal Hooda <quic_khooda@quicinc.com>
This commit is contained in:
Kaushal Hooda 2023-06-20 11:06:00 +05:30
commit ab0f86134f
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/rpmsg/qcom_glink_slatecom.c
View file

@ -1935,7 +1935,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
case SLATECOM_CMD_CLOSE_ACK:
glink_slatecom_rx_defer(glink,
rx_data + offset - sizeof(*msg),
rx_size + offset - sizeof(*msg), 0);
rx_size - offset + sizeof(*msg), 0);
break;
case SLATECOM_CMD_RX_INTENT_REQ:
glink_slatecom_handle_intent_req(glink, param1, param2);
@ -1948,7 +1948,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
name = rx_data + offset;
glink_slatecom_rx_defer(glink,
rx_data + offset - sizeof(*msg),
rx_size + offset - sizeof(*msg),
rx_size - offset + sizeof(*msg),
ALIGN(name_len, SLATECOM_ALIGNMENT));
offset += ALIGN(name_len, SLATECOM_ALIGNMENT);