Commit 413db77d authored Dec 04, 2013 by Zaheerulla Meer

msm: smd_pkt: Validate the size of SMD packet on read



In a scenario where the SMD packet size is invalid(> 0x7fffffff),
when smd_pkt reads this packet the size gets rounded off to a
negative number. This causes smd_pkt to wait till entire packet is read
rather than returning -ETOOSMALL.

Validate the packet size and return error in case the size if a negative
number.

CRs-Fixed: 579605
Change-Id: I163361c86f9de4c61dfc6bb8b2ce3f918e433302
Signed-off-by: Zaheerulla Meer <zmeer@codeaurora.org>

parent 61ead888

arch/arm/mach-msm/smd_pkt.c

+7 −1

Original line number	Diff line number	Diff line
		@@ -487,7 +487,13 @@ wait_for_packet:
		goto wait_for_packet;
		}

		if (pkt_size > count) {
		if (pkt_size < 0) {
		pr_err("%s: Error %d obtaining packet size for Channel %s",
		__func__, pkt_size, smd_pkt_devp->ch_name);
		return pkt_size;
		}

		if ((uint32_t)pkt_size > count) {
		pr_err("%s: failure on smd_pkt_dev id: %d - packet size %d"
		" > buffer size %d,", __func__, smd_pkt_devp->i,
		pkt_size, count);