Parcourir la source

msm: eva: overflow issue in vm msq receiver function

OOB write in VM message Q receiver function.

Change-Id: I99d8b5f792c10cfb05387520e3e995f43d02ee29
Signed-off-by: Gopireddy Arunteja Reddy <[email protected]>
Gopireddy Arunteja Reddy il y a 10 mois
Parent
commit
edd1ef2468
1 fichiers modifiés avec 2 ajouts et 1 suppressions
  1. 2 1
      msm/eva/vm/cvp_vm_msgq.c

+ 2 - 1
msm/eva/vm/cvp_vm_msgq.c

@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-only
  *
  * Copyright (c) 2022, Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2023-2024 Qualcomm Innovation Center, Inc. All rights reserved.
  */
 
 #include <linux/kthread.h>
@@ -37,7 +38,7 @@ static int cvp_msgq_receiver(void *data)
 
 	while (true) {
 		rc = gh_msgq_recv(msgq_drv->config.handle, msg_ptr,
-			GH_MSGQ_MAX_MSG_SIZE_BYTES, &size, 0);
+			sizeof(*msg_ptr), &size, 0);
 
 		if (rc != 0 ) {
 			dprintk(CVP_ERR,