Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dd473e6c authored by Guru Das Srinagesh's avatar Guru Das Srinagesh Committed by Gerrit - the friendly Code Review server
Browse files

haven: hh_rm_core: Change datatype of num_fragments 



Integer overflow can occur for a large value of req_buff_size because
num_fragments is declared as u8. Declare it as int in order to prevent
this from occurring.

Change-Id: I9e3655af13134ec57d123317ebb7b287a7470a19
Signed-off-by: default avatarGuru Das Srinagesh <gurus@codeaurora.org>
Signed-off-by: default avatarSwetha Chikkaboraiah <schikk@codeaurora.org>
parent 3b06ec12

drivers/virt/haven/hh_rm_core.c

+2 −2
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2021, The Linux Foundation. All rights reserved.

 *

 */
@@ -485,7 +485,7 @@ static int hh_rm_send_request(u32 message_id, 
	const void *req_buff_curr = req_buff;

	struct hh_rm_rpc_hdr *hdr;

	unsigned long tx_flags;

	u8 num_fragments = 0;

	u32 num_fragments = 0;

	size_t payload_size;

	void *send_buff;

	int i, ret;