A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "rpmsg: slatecom: out of bound read from process_cmd"

Browse source
This commit is contained in:
qctecmdr 2024-03-07 03:35:40 -08:00 • committed by Gerrit - the friendly Code Review server
commit ef7ec434b5
1 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/rpmsg/qcom_glink_slatecom.c
View file

@ -1900,7 +1900,7 @@ static void glink_slatecom_handle_rx_done(struct glink_slatecom *glink,
mutex_unlock(&channel->intent_lock);
}
static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_data,
static int glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_data,
u32 rx_size)
{
struct glink_slatecom_msg *msg;
@ -1909,12 +1909,18 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
unsigned int param3;
unsigned int param4;
unsigned int cmd;
int offset = 0;
int ret;
u32 offset = 0;
int ret = 0;
u16 name_len;
char *name;
while (offset < rx_size) {
if (rx_size - offset < sizeof(struct glink_slatecom_msg)) {
ret = -EBADMSG;
GLINK_ERR(glink, "%s: Error %d process cmd\n", __func__, ret);
return ret;
}
msg = (struct glink_slatecom_msg *)(rx_data + offset);
offset += sizeof(*msg);
@ -1997,6 +2003,7 @@ static void glink_slatecom_process_cmd(struct glink_slatecom *glink, void *rx_da
break;
}
}
return ret;
}
/**