diff options
| author | Robin Peng <robinpeng@google.com> | 2022-05-06 14:23:14 +0800 |
|---|---|---|
| committer | Robin Peng <robinpeng@google.com> | 2022-05-06 14:23:14 +0800 |
| commit | 9dd1c348c400ae37c639912e7ff3c07f6390e321 (patch) | |
| tree | 0580822c3c9436468ed6b6d7e1130a53d0b80878 | |
| parent | 9eda54289b49a0b9378fa2ba03f876a565df77e4 (diff) | |
| parent | eba40aecb3b7b9b88eac1e367e57632a70ec8436 (diff) | |
| download | gs-android-gs-raviole-5.10-android12-qpr3.tar.gz | |
Merge android12-5.10-2022-03_r5 into android12-gs-pixel-5.10-sc-qpr3android-12.1.0_r0.35android-gs-raviole-5.10-android12-qpr3
Merge SHA
eba40ae UPSTREAM: atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait
Bug: 215048134
Signed-off-by: Robin Peng <robinpeng@google.com>
Change-Id: Ia939dd370e981969f7e69dd6956da7f45ac8d71d
| -rw-r--r-- | drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c index 404cbf60d3f2..da1d185f6d22 100644 --- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c @@ -559,6 +559,11 @@ int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self, goto err_exit; if (fw.len == 0xFFFFU) { + if (sw.len > sizeof(self->rpc)) { + printk(KERN_INFO "Invalid sw len: %x\n", sw.len); + err = -EINVAL; + goto err_exit; + } err = hw_atl_utils_fw_rpc_call(self, sw.len); if (err < 0) goto err_exit; @@ -567,6 +572,11 @@ int hw_atl_utils_fw_rpc_wait(struct aq_hw_s *self, if (rpc) { if (fw.len) { + if (fw.len > sizeof(self->rpc)) { + printk(KERN_INFO "Invalid fw len: %x\n", fw.len); + err = -EINVAL; + goto err_exit; + } err = hw_atl_utils_fw_downld_dwords(self, self->rpc_addr, |