A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

rpmsg: slatecom: Discard unaligned packet to read

Browse source 
If intent_alloc_size and chunk size are unaligned with the minimum offset,
then ahb_read can lead to bytes overflow as ahb_read is performed
with word_size aligned.

If the received chunk_size is not aligned to word_size, discard packet
to read.

Change-Id: Iae2c87636675da653bd182ac082a285b699e0a83
Signed-off-by: Kaushal Hooda <quic_khooda@quicinc.com>
This commit is contained in:
Kaushal Hooda 2023-06-01 23:45:30 +05:30
commit acf2f0eb6a
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/rpmsg/qcom_glink_slatecom.c
View file

@ -1694,12 +1694,21 @@ static int glink_slatecom_rx_data(struct glink_slatecom *glink,
if (intent->size - intent->offset < chunk_size) {
dev_err(glink->dev, "Insufficient space in intent\n");
glink_slatecom_free_intent(channel, intent);
mutex_unlock(&channel->intent_lock);
/* The packet header lied, drop payload */
return msglen;
}
if (chunk_size % WORD_SIZE) {
dev_err(glink->dev, "For chunk_size %d use short packet\n",
chunk_size);
glink_slatecom_free_intent(channel, intent);
mutex_unlock(&channel->intent_lock);
return -EBADMSG;
}
rc = slatecom_ahb_read(glink->slatecom_handle, (uint32_t)(size_t)addr,
ALIGN(chunk_size, WORD_SIZE)/WORD_SIZE,
intent->data + intent->offset);