A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

haven: hh_rm_core: Check payload size in hh_rm_init_connection_buff()

Browse source 
Ensure that the payload being copied to the connection's recv_buff
buffer does not exceed the buffer's maximum size.

Change-Id: Ic0e0b894e7746430916b24f45e583822ccea2748
Signed-off-by: Srinivasarao Pathipati <quic_spathi@quicinc.com>
This commit is contained in:
Srinivasarao Pathipati 2021-10-18 14:41:31 +05:30
commit e404838e08
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/virt/haven/hh_rm_core.c
View file

@ -90,18 +90,25 @@ hh_rm_init_connection_buff(struct hh_rm_connection *connection,
size_t payload_size)
{
struct hh_rm_rpc_hdr *hdr = recv_buff;
size_t max_buf_size;
/* Some of the 'reply' types doesn't contain any payload */
if (!payload_size)
return 0;
max_buf_size = (HH_MSGQ_MAX_MSG_SIZE_BYTES - hdr_size) *
(hdr->fragments + 1);
if (payload_size > max_buf_size) {
pr_err("%s: Payload size exceeds max buff size\n", __func__);
return -EINVAL;
}
/* If the data is split into multiple fragments, allocate a large
* enough buffer to hold the payloads for all the fragments.
*/
connection->recv_buff = connection->current_recv_buff =
kzalloc((HH_MSGQ_MAX_MSG_SIZE_BYTES - hdr_size) *
(hdr->fragments + 1),
GFP_KERNEL);
kzalloc(max_buf_size, GFP_KERNEL);
if (!connection->recv_buff)
return -ENOMEM;