From dd3f8fe03f7861ca9ac97bcd36761cbb33a57038 Mon Sep 17 00:00:00 2001 From: Praveen koya Date: Tue, 30 May 2023 14:47:21 +0530 Subject: [PATCH] soc: qcom: add buffer overflow check on AON rx_buffer Add buffer overflow check while accessing data buffer received from AON Mot-CRs-fixed: (CR) CVE-Fixed: CVE-2023-33085 CRs-Fixed: 3512209 Change-Id: I0472a0ad1e6edc3fe8102850fddacd89ceea4959 Signed-off-by: Praveen koya Signed-off-by: Ashutosh Verma Reviewed-on: https://gerrit.mot.com/2762750 SLTApproved: Slta Waiver SME-Granted: SME Approvals Granted Tested-by: Jira Key Reviewed-by: Xiangpo Zhao Submit-Approved: Jira Key --- drivers/soc/qcom/slatecom_interface.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/slatecom_interface.c b/drivers/soc/qcom/slatecom_interface.c index 9517cd8c877a..0001b31dbe21 100644 --- a/drivers/soc/qcom/slatecom_interface.c +++ b/drivers/soc/qcom/slatecom_interface.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #define pr_fmt(msg) "slatecom_dev:" msg @@ -44,6 +45,7 @@ #define MPPS_DOWN_EVENT_TO_SLATE_TIMEOUT 3000 #define ADSP_DOWN_EVENT_TO_SLATE_TIMEOUT 3000 #define MAX_APP_NAME_SIZE 100 +#define SCOM_GLINK_INTENT_SIZE 308 /*pil_slate_intf.h*/ #define RESULT_SUCCESS 0 @@ -99,7 +101,7 @@ struct slatedaemon_priv { bool slate_resp_cmplt; void *lhndl; wait_queue_head_t link_state_wait; - char rx_buf[20]; + char rx_buf[SCOM_GLINK_INTENT_SIZE]; struct mutex glink_mutex; }; static void *slatecom_intf_drv; @@ -204,6 +206,10 @@ void slatecom_rx_msg(void *data, int len) struct slatedaemon_priv *dev = container_of(slatecom_intf_drv, struct slatedaemon_priv, lhndl); + if (len > SCOM_GLINK_INTENT_SIZE) { + pr_err("Invalid slatecom_intf glink intent size\n"); + return; + } dev->slate_resp_cmplt = true; wake_up(&dev->link_state_wait); memcpy(dev->rx_buf, data, len);