A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

rpmsg: slatecom: Discard unaligned packet to read

Browse source 
If intent_alloc_size and chunk size are unaligned with the minimum offset,
then ahb_read can lead to bytes overflow as ahb_read is performed
with word_size aligned.

If the received chunk_size is not aligned to word_size, discard packet
to read.

Change-Id: I36fabc8bde22355de1ae32cb026a2a246778d47e
Signed-off-by: Kaushal Hooda <quic_khooda@quicinc.com>
This commit is contained in:
Kaushal Hooda 2023-06-05 14:14:43 +05:30 • committed by Michael Bestas
commit c670d30054
No known key found for this signature in database
GPG key ID: CC95044519BE6669
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/rpmsg/qcom_glink_slatecom.c
View file

@ -1694,12 +1694,21 @@ static int glink_slatecom_rx_data(struct glink_slatecom *glink,
if (intent->size - intent->offset < chunk_size) {
dev_err(glink->dev, "Insufficient space in intent\n");
glink_slatecom_free_intent(channel, intent);
mutex_unlock(&channel->intent_lock);
/* The packet header lied, drop payload */
return msglen;
}
if (chunk_size % WORD_SIZE) {
dev_err(glink->dev, "For chunk_size %d use short packet\n",
chunk_size);
glink_slatecom_free_intent(channel, intent);
mutex_unlock(&channel->intent_lock);
return msglen;
}
rc = slatecom_ahb_read(glink->slatecom_handle, (uint32_t)(size_t)addr,
ALIGN(chunk_size, WORD_SIZE)/WORD_SIZE,
intent->data + intent->offset);