Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 030dd42f authored by Guru Das Srinagesh's avatar Guru Das Srinagesh
Browse files

soc: altmode: Add correct notify message length check 



Add a check to ensure that the remote subsystem sends the full and
expected length of the notification message.

Change-Id: I78d2c708c924cb864b7636bda81f290e310beb54
Signed-off-by: default avatarGuru Das Srinagesh <gurus@codeaurora.org>
parent cf47a886

drivers/soc/qcom/altmode-glink.c

+9 −10
Original line number Original line Diff line number Diff line
@@ -19,7 +19,6 @@ 
#define MSG_OWNER_USBC_PAN	32780

#define MSG_OWNER_USBC_PAN	32780

#define MSG_TYPE_REQ_RESP	1

#define MSG_TYPE_REQ_RESP	1





#define MIN_PAYLOAD_SIZE	9

#define NOTIFY_PAYLOAD_SIZE	16

#define NOTIFY_PAYLOAD_SIZE	16

#define USBC_WRITE_BUFFER_SIZE	8

#define USBC_WRITE_BUFFER_SIZE	8
@@ -526,7 +525,6 @@ static int altmode_callback(void *priv, void *data, size_t len) 
	struct pmic_glink_hdr *hdr = data;

	struct pmic_glink_hdr *hdr = data;

	struct altmode_dev *amdev = priv;

	struct altmode_dev *amdev = priv;

	struct altmode_client *amclient;

	struct altmode_client *amclient;

	u8 payload_len;

	u8 port_index;

	u8 port_index;





	pr_debug("len: %zu owner: %u type: %u opcode %04x\n", len, hdr->owner,

	pr_debug("len: %zu owner: %u type: %u opcode %04x\n", len, hdr->owner,
@@ -545,13 +543,11 @@ static int altmode_callback(void *priv, void *data, size_t len) 
		complete(&amdev->response_received);

		complete(&amdev->response_received);

		break;

		break;

	case USBC_NOTIFY_IND:

	case USBC_NOTIFY_IND:

		payload_len = NOTIFY_PAYLOAD_SIZE;

		if (len != sizeof(*notify_msg)) {

		if (len < sizeof(*notify_msg))

			pr_debug("Expected length %u, got: %zu\n",

			payload_len = len - sizeof(*hdr);

					sizeof(*notify_msg), len);



		/* payload should at least contain 9 bytes */

		if (payload_len < MIN_PAYLOAD_SIZE)

			return -EINVAL;

			return -EINVAL;

		}





		notify_msg = data;

		notify_msg = data;

		port_index = notify_msg->payload[0];

		port_index = notify_msg->payload[0];
@@ -570,9 +566,12 @@ static int altmode_callback(void *priv, void *data, size_t len) 
			return 0;

			return 0;

		}

		}





		pr_debug("Payload: %*ph\n", payload_len, notify_msg->payload);

		pr_debug("Payload: %*ph\n", NOTIFY_PAYLOAD_SIZE,

				notify_msg->payload);



		cancel_work_sync(&amclient->client_cb_work);

		cancel_work_sync(&amclient->client_cb_work);

		memcpy(&amclient->msg, notify_msg->payload, payload_len);

		memcpy(&amclient->msg, notify_msg->payload,

				sizeof(amclient->msg));

		schedule_work(&amclient->client_cb_work);

		schedule_work(&amclient->client_cb_work);

		break;

		break;

	default:

	default: