Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9ee69c5 authored by Zhao Qiang's avatar Zhao Qiang Committed by Scott Wood
Browse files

qe/ic: fix a buffer overflow error and add check elsewhere 



127 is the theoretical up boundary of QEIC number,
in fact there only be 44 qe_ic_info now.
add check to overflow for qe_ic_info

Signed-off-by: default avatarZhao Qiang <qiang.zhao@nxp.com>
Acked-by: default avatarLi Yang <leoyang.li@nxp.com>
Signed-off-by: default avatarScott Wood <oss@buserror.net>
parent ea6370d2

drivers/soc/fsl/qe/qe_ic.c

+10 −1
Original line number Diff line number Diff line
@@ -259,6 +259,11 @@ static int qe_ic_host_map(struct irq_domain *h, unsigned int virq, 
	struct qe_ic *qe_ic = h->host_data;

	struct irq_chip *chip;



	if (hw >= ARRAY_SIZE(qe_ic_info)) {

		pr_err("%s: Invalid hw irq number for QEIC\n", __func__);

		return -EINVAL;

	}



	if (qe_ic_info[hw].mask == 0) {

		printk(KERN_ERR "Can't map reserved IRQ\n");

		return -EINVAL;
@@ -407,7 +412,8 @@ int qe_ic_set_priority(unsigned int virq, unsigned int priority) 


	if (priority > 8 || priority == 0)

		return -EINVAL;

	if (src > 127)

	if (WARN_ONCE(src >= ARRAY_SIZE(qe_ic_info),

		      "%s: Invalid hw irq number for QEIC\n", __func__))

		return -EINVAL;

	if (qe_ic_info[src].pri_reg == 0)

		return -EINVAL;
@@ -436,6 +442,9 @@ int qe_ic_set_high_priority(unsigned int virq, unsigned int priority, int high) 


	if (priority > 2 || priority == 0)

		return -EINVAL;

	if (WARN_ONCE(src >= ARRAY_SIZE(qe_ic_info),

		      "%s: Invalid hw irq number for QEIC\n", __func__))

		return -EINVAL;



	switch (qe_ic_info[src].pri_reg) {

	case QEIC_CIPZCC: