From ab0f86134fcb5d4e066dffcc6e1684138e96337d Mon Sep 17 00:00:00 2001 From: Kaushal Hooda Date: Tue, 20 Jun 2023 11:06:00 +0530 Subject: [PATCH] rpmsg: slatecom: maintain rx_size to read For cmd close_ack or open request where rx_size is being incrementing with respect to offset might lead to out of bound read from rx_data. Decrease rx_size as we process commands. Change-Id: I492eadcbebb78386fc20f744eb9ad8db4a2914fc Signed-off-by: Kaushal Hooda --- drivers/rpmsg/qcom_glink_slatecom.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/rpmsg/qcom_glink_slatecom.c b/drivers/rpmsg/qcom_glink_slatecom.c index d57adfa3c92f..79e241a04ce5 100644 --- a/drivers/rpmsg/qcom_glink_slatecom.c +++ b/drivers/rpmsg/qcom_glink_slatecom.c @@ -1935,7 +1935,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da case SLATECOM_CMD_CLOSE_ACK: glink_slatecom_rx_defer(glink, rx_data + offset - sizeof(*msg), - rx_size + offset - sizeof(*msg), 0); + rx_size - offset + sizeof(*msg), 0); break; case SLATECOM_CMD_RX_INTENT_REQ: glink_slatecom_handle_intent_req(glink, param1, param2); @@ -1948,7 +1948,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da name = rx_data + offset; glink_slatecom_rx_defer(glink, rx_data + offset - sizeof(*msg), - rx_size + offset - sizeof(*msg), + rx_size - offset + sizeof(*msg), ALIGN(name_len, SLATECOM_ALIGNMENT)); offset += ALIGN(name_len, SLATECOM_ALIGNMENT);