A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 03:01:39 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina

Browse source 
"LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0"

* tag 'LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
  qcedev: fix UAF in qcedev_smmu
  msm: cvp: OOB write fix due to integer underflow
  msm: eva: Adding kref count for cvp_get_inst_from_id
  msm: kgsl: Fix error handling during drawctxt switch
  msm_ipa: EoGRE Multi tunnel support
  usb: dwc3: Fix dwc3 version and revisions in remote wakeup path
  usb: gadget: f_cdev: Add remote wakeup capability from notify_serial_state
  power: reset: qcom-dload-mode: nodump mode error handling
  firmware: qcom_scm: Add a call for getting dload mode
  msm: kgsl: Fix error handling during drawctxt switch
  power: reset: qcom-dload-mode: support for nodump mode
  defconfig: sdxlemur: Enable nodump support for sdxlemur
  PCI: Disable L0s support for SDX65 with QPS615 on CPE platform
  msm: adsprpc: use-after-free (UAF) in global maps
  UPSTREAM: xhci: prepare for operation without shared HCD
  rpmsg: glink: Get reference of channel objects in rx path
  msm_ipa: Tunnel Config structure changes
  soc: qcom: mdt_loader: add bound checks for headers
  BACKPORT: media: venus: hfi: add checks in capabilities from firmware

Change-Id: Idae516c9223cb306b362ad22f031735cd856d59f
This commit is contained in:
Michael Bestas 2024-08-05 21:53:23 +03:00
commit ea1c711e8f
No known key found for this signature in database
GPG key ID: CC95044519BE6669
21 changed files with 387 additions and 220 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/soc/qcom/mdt_loader.c
View file

@ -92,10 +92,16 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
size_t ehdr_size;
void *data;
if (fw->size < sizeof(struct elf32_hdr)) {
dev_err(dev, "Image is too small\n");
return ERR_PTR(-EINVAL);
}
ehdr = (struct elf32_hdr *)fw->data;
phdrs = (struct elf32_phdr *)(ehdr + 1);
if (ehdr->e_phnum < 2 || ehdr->e_phnum > PN_XNUM)
if (ehdr->e_phnum < 2 || ehdr->e_phoff > fw->size ||
(sizeof(phdrs) * ehdr->e_phnum > fw->size - ehdr->e_phoff))
return ERR_PTR(-EINVAL);
if (phdrs[0].p_type == PT_LOAD)