Add CVE-2019-10499 patch (461d0680) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/rpmsg/qcom_glink_smem.c

+19 −4

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2016, Linaro Ltd
		* Copyright (c) 2018, The Linux Foundation, All rights reserved.
		* Copyright (c) 2018-2019, The Linux Foundation, All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -80,9 +80,14 @@ static size_t glink_smem_rx_avail(struct qcom_glink_pipe *np)
		tail = le32_to_cpu(*pipe->tail);

		if (head < tail)
		return pipe->native.length - tail + head;
		len = pipe->native.length - tail + head;
		else
		return head - tail;
		len = head - tail;

		if (WARN_ON_ONCE(len > pipe->native.length))
		len = 0;

		return len;
		}

		static void glink_smem_rx_peak(struct qcom_glink_pipe *np,
		@@ -93,6 +98,10 @@ static void glink_smem_rx_peak(struct qcom_glink_pipe *np,
		u32 tail;

		tail = le32_to_cpu(*pipe->tail);

		if (WARN_ON_ONCE(tail > pipe->native.length))
		return;

		tail += offset;
		if (tail >= pipe->native.length)
		tail -= pipe->native.length;
		@@ -117,7 +126,7 @@ static void glink_smem_rx_advance(struct qcom_glink_pipe *np,

		tail += count;
		if (tail >= pipe->native.length)
		tail -= pipe->native.length;
		tail %= pipe->native.length;

		*pipe->tail = cpu_to_le32(tail);
		}
		@@ -142,6 +151,9 @@ static size_t glink_smem_tx_avail(struct qcom_glink_pipe *np)
		else
		avail -= FIFO_FULL_RESERVE + TX_BLOCKED_CMD_RESERVE;

		if (WARN_ON_ONCE(avail > pipe->native.length))
		avail = 0;

		return avail;
		}

		@@ -151,6 +163,9 @@ static unsigned int glink_smem_tx_write_one(struct glink_smem_pipe *pipe,
		{
		size_t len;

		if (WARN_ON_ONCE(head > pipe->native.length))
		return head;

		len = min_t(size_t, count, pipe->native.length - head);
		if (len)
		memcpy(pipe->fifo + head, data, len);