Merge "usb: pd: avoid out-of-bounds access when reading PDOs" (f3dcbfee) · Commits · e / devices / android_kernel_sony_msm8998

drivers/usb/pd/policy_engine.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -2253,8 +2253,11 @@ static void usbpd_sm(struct work_struct *w)
		&val);

		/* save the PDOs so userspace can further evaluate */
		memcpy(&pd->received_pdos, rx_msg->payload,
		memset(&pd->received_pdos, 0,
		sizeof(pd->received_pdos));
		memcpy(&pd->received_pdos, rx_msg->payload,
		min_t(size_t, rx_msg->data_len,
		sizeof(pd->received_pdos)));
		pd->src_cap_id++;

		usbpd_set_state(pd, PE_SNK_EVALUATE_CAPABILITY);
		@@ -2365,8 +2368,11 @@ static void usbpd_sm(struct work_struct *w)
		case PE_SNK_READY:
		if (IS_DATA(rx_msg, MSG_SOURCE_CAPABILITIES)) {
		/* save the PDOs so userspace can further evaluate */
		memcpy(&pd->received_pdos, rx_msg->payload,
		memset(&pd->received_pdos, 0,
		sizeof(pd->received_pdos));
		memcpy(&pd->received_pdos, rx_msg->payload,
		min_t(size_t, rx_msg->data_len,
		sizeof(pd->received_pdos)));
		pd->src_cap_id++;

		usbpd_set_state(pd, PE_SNK_EVALUATE_CAPABILITY);