Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e80a8aa9 authored by Deepak Kumar Singh's avatar Deepak Kumar Singh Committed by Arun Kumar Neelakantam
Browse files

rpmsg : glink: validate head and tail index before fifo read write 



We are not validating head and tail index of tx and rx fifo
before using to read or write fifo. This can result in out of
bound memory access if head and tail have incorrect values.

This patch adds check for validation of head and tail index.

CRs-Fixed: 2398099
Change-Id: Ia8725a731cc7a45f7e13b09e1e62842ff44d53f3
Signed-off-by: default avatarDeepak Kumar Singh <deesin@codeaurora.org>
parent 71ba584c

drivers/rpmsg/qcom_glink_smem.c

+19 −4
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Copyright (c) 2016, Linaro Ltd

 * Copyright (c) 2018, The Linux Foundation, All rights reserved.

 * Copyright (c) 2018-2019, The Linux Foundation, All rights reserved.

 */



#include <linux/io.h>
@@ -72,9 +72,14 @@ static size_t glink_smem_rx_avail(struct qcom_glink_pipe *np) 
	tail = le32_to_cpu(*pipe->tail);



	if (head < tail)

		return pipe->native.length - tail + head;

		len = pipe->native.length - tail + head;

	else

		return head - tail;

		len = head - tail;



	if (WARN_ON_ONCE(len > pipe->native.length))

		len = 0;



	return len;

}



static void glink_smem_rx_peak(struct qcom_glink_pipe *np,
@@ -85,6 +90,10 @@ static void glink_smem_rx_peak(struct qcom_glink_pipe *np, 
	u32 tail;



	tail = le32_to_cpu(*pipe->tail);



	if (WARN_ON_ONCE(tail > pipe->native.length))

		return;



	tail += offset;

	if (tail >= pipe->native.length)

		tail -= pipe->native.length;
@@ -109,7 +118,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np, 


	tail += count;

	if (tail >= pipe->native.length)

		tail -= pipe->native.length;

		tail %= pipe->native.length;



	*pipe->tail = cpu_to_le32(tail);

}
@@ -134,6 +143,9 @@ static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np) 
	else

		avail -= FIFO_FULL_RESERVE + TX_BLOCKED_CMD_RESERVE;



	if (WARN_ON_ONCE(avail > pipe->native.length))

		avail = 0;



	return avail;

}
@@ -143,6 +155,9 @@ static unsigned int glink_smem_tx_write_one(struct glink_smem_pipe *pipe, 
{

	size_t len;



	if (WARN_ON_ONCE(head > pipe->native.length))

		return head;



	len = min_t(size_t, count, pipe->native.length - head);

	if (len)

		memcpy(pipe->fifo + head, data, len);