A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 21:22:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

soc: qcom: add buffer overflow check on AON rx_buffer

Browse source 
Add buffer overflow check while accessing data buffer
received from AON

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2023-33085
CRs-Fixed: 3512209
Change-Id: I0472a0ad1e6edc3fe8102850fddacd89ceea4959
Signed-off-by: Praveen koya <quic_pkoya@quicinc.com>
Signed-off-by: Ashutosh Verma <ashverma@motorola.com>
Reviewed-on: https://gerrit.mot.com/2762750
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
This commit is contained in:
Praveen koya 2023-05-30 14:47:21 +05:30 • committed by Xiaojun Ji
commit dd3f8fe03f
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/soc/qcom/slatecom_interface.c
View file

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2017-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
#define pr_fmt(msg) "slatecom_dev:" msg
@ -44,6 +45,7 @@
#define MPPS_DOWN_EVENT_TO_SLATE_TIMEOUT 3000
#define ADSP_DOWN_EVENT_TO_SLATE_TIMEOUT 3000
#define MAX_APP_NAME_SIZE 100
#define SCOM_GLINK_INTENT_SIZE 308
/*pil_slate_intf.h*/
#define RESULT_SUCCESS 0
@ -99,7 +101,7 @@ struct slatedaemon_priv {
bool slate_resp_cmplt;
void *lhndl;
wait_queue_head_t link_state_wait;
char rx_buf[20];
char rx_buf[SCOM_GLINK_INTENT_SIZE];
struct mutex glink_mutex;
};
static void *slatecom_intf_drv;
@ -204,6 +206,10 @@ void slatecom_rx_msg(void *data, int len)
struct slatedaemon_priv *dev =
container_of(slatecom_intf_drv, struct slatedaemon_priv, lhndl);
if (len > SCOM_GLINK_INTENT_SIZE) {
pr_err("Invalid slatecom_intf glink intent size\n");
return;
}
dev->slate_resp_cmplt = true;
wake_up(&dev->link_state_wait);
memcpy(dev->rx_buf, data, len);