Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

soc: qcom: Validate read and write index before calculating ptr 

Currently we are not validating read and write index of
tx and rx fifo's before calculating ptr, this can lead to
out-of-bound access. The patch adds proper check for the same.

Change-Id: I7b158e94ae743a90ac364783fe31914ca0fa582b
Signed-off-by: Hardik Arya <harya@codeaurora.org>
This commit is contained in:
Hardik Arya 2019-01-04 16:14:20 +05:30 committed by syphyr
parent 9491eb8616
commit 64e5ce5cc5
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/soc/qcom/glink_smem_native_xprt.c
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2014-2015, 2019 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -407,6 +407,8 @@ static int fifo_read(struct edge_info *einfo, void *_data, int len)
uint32_t fifo_size = einfo->rx_fifo_size;
uint32_t n;
if (read_index >= fifo_size || write_index >= fifo_size)
return 0;
while (len) {
ptr = einfo->rx_fifo + read_index;
if (read_index <= write_index)
@ -450,6 +452,8 @@ static uint32_t fifo_write_body(struct edge_info *einfo, const void *_data,
uint32_t fifo_size = einfo->tx_fifo_size;
uint32_t n;
if (read_index >= fifo_size || *write_index >= fifo_size)
return 0;
while (len) {
ptr = einfo->tx_fifo + *write_index;
if (*write_index < read_index) {