소스 검색

cnss2: Fix mbox_msg size calculated

Current code passes in mbox_msg max buffer
size to mailbox api rather than actual string
length. Resulting in KASAN detecting an out of
bound issue. Fix this by calculating the string
length, and passing that in.

CRs-Fixed: 3876948
Change-Id: I7d9be5466ca5bec81e181f47e278205d6d9a64ce
Mohammed Ahmed 1 년 전
부모
커밋
234bc26709
1개의 변경된 파일9개의 추가작업 그리고 1개의 파일을 삭제
  1. 9 1
      cnss2/power.c

+ 9 - 1
cnss2/power.c

@@ -1415,13 +1415,21 @@ static int
 cnss_mbox_send_msg(struct cnss_plat_data *plat_priv, char *mbox_msg)
 {
 	struct qmp_pkt pkt;
+	int mbox_msg_size;
 	int ret = 0;
 
 	if (!plat_priv->mbox_chan)
 		return -ENODEV;
 
+	mbox_msg_size = strlen(mbox_msg) + 1;
+
+	if (mbox_msg_size > CNSS_MBOX_MSG_MAX_LEN) {
+		cnss_pr_err("message length greater than max length\n");
+		return -EINVAL;
+	}
+
 	cnss_pr_dbg("Sending AOP Mbox msg: %s\n", mbox_msg);
-	pkt.size = CNSS_MBOX_MSG_MAX_LEN;
+	pkt.size = mbox_msg_size;
 	pkt.data = mbox_msg;
 	ret = mbox_send_message(plat_priv->mbox_chan, &pkt);
 	if (ret < 0)