Merge "soc: qcom: pil: Avoid possible buffer overflow" (bafd4c66) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/soc/qcom/pil-msa.c

+3 −4

Original line number	Diff line number	Diff line
		@@ -615,7 +615,7 @@ int pil_mss_reset_load_mba(struct pil_desc *pil)
		char *fw_name_p;
		void *mba_dp_virt;
		dma_addr_t mba_dp_phys, mba_dp_phys_end;
		int ret, count;
		int ret;
		const u8 *data;
		struct device *dma_dev = md->mba_mem_dev_fixed ?: &md->mba_mem_dev;

		@@ -681,10 +681,9 @@ int pil_mss_reset_load_mba(struct pil_desc *pil)
		&mba_dp_phys, &mba_dp_phys_end);

		/* Load the MBA image into memory */
		count = fw->size;
		if (count <= SZ_1M) {
		if (fw->size <= SZ_1M) {
		/* Ensures memcpy is done for max 1MB fw size */
		memcpy(mba_dp_virt, data, count);
		memcpy(mba_dp_virt, data, fw->size);
		} else {
		dev_err(pil->dev, "%s fw image loading into memory is failed due to fw size overflow\n",
		__func__);