Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cae0d5a6 authored by Kishor PK's avatar Kishor PK Committed by Gerrit - the friendly Code Review server
Browse files

soc: qcom: pil: Avoid possible buffer overflow during Modem boot 



Buffer overflow can occur if MBA firmware size exceeds 1MB.
So validate size before copying the firmware.

CRs-Fixed: 2001803
Change-Id: I070ddf85fbc47df072e7258369272366262ebf46
Signed-off-by: default avatarKishor PK <kpbhat@codeaurora.org>
parent 7514c164

drivers/soc/qcom/pil-msa.c

+9 −1
Original line number Diff line number Diff line
@@ -616,7 +616,15 @@ int pil_mss_reset_load_mba(struct pil_desc *pil) 


	/* Load the MBA image into memory */

	count = fw->size;

	if (count <= SZ_1M) {

		/* Ensures memcpy is done for max 1MB fw size */

		memcpy(mba_dp_virt, data, count);

	} else {

		dev_err(pil->dev, "%s fw image loading into memory is failed due to fw size overflow\n",

			__func__);

		 ret = -EINVAL;

		 goto err_mba_data;

	}

	/* Ensure memcpy of the MBA memory is done before loading the DP */

	wmb();