Explorar o código

msm: eva: overflow issue in vm msq receiver function

OOB write in VM message Q receiver function.

Change-Id: I99d8b5f792c10cfb05387520e3e995f43d02ee29
Signed-off-by: Gopireddy Arunteja Reddy <[email protected]>
(cherry picked from commit edd1ef24688e296591db54fac0f81f2ff42c6071)
Gopireddy Arunteja Reddy hai 10 meses
pai
achega
e1a1fe3d65
Modificáronse 1 ficheiros con 2 adicións e 1 borrados
  1. 2 1
      msm/eva/vm/cvp_vm_msgq.c

+ 2 - 1
msm/eva/vm/cvp_vm_msgq.c

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only
  *
  * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/kthread.h>
@@ -37,7 +38,7 @@ static int cvp_msgq_receiver(void *data)
 
 	while (true) {
 		rc = gh_msgq_recv(msgq_drv->config.handle, msg_ptr,
-			GH_MSGQ_MAX_MSG_SIZE_BYTES, &size, 0);
+			sizeof(*msg_ptr), &size, 0);
 
 		if (rc != 0 ) {
 			dprintk(CVP_ERR,