Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64043b41 authored by Mohammed Javid's avatar Mohammed Javid
Browse files

msm: ipa: Fix boundary cross on array element 



Fix possible attempt of accessing MAX array element.

Change-Id: Ia117565b6cadb1eafe91df16b2441afd1ffd13a8
Signed-off-by: default avatarMohammed Javid <mjavid@codeaurora.org>
parent a74a42c2

drivers/platform/msm/ipa/ipa_v2/ipa_debugfs.c

+5 −5
Original line number Diff line number Diff line
@@ -431,7 +431,7 @@ static ssize_t ipa_read_hdr(struct file *file, char __user *ubuf, size_t count, 
			link) {

		nbytes = scnprintf(

			dbg_buff,

			IPA_MAX_MSG_LEN,

			IPA_MAX_MSG_LEN - 1,

			"name:%s len=%d ref=%d partial=%d type=%s ",

			entry->name,

			entry->hdr_len,
@@ -442,23 +442,23 @@ static ssize_t ipa_read_hdr(struct file *file, char __user *ubuf, size_t count, 
		if (entry->is_hdr_proc_ctx) {

			nbytes += scnprintf(

				dbg_buff + nbytes,

				IPA_MAX_MSG_LEN - nbytes,

				IPA_MAX_MSG_LEN - 1 - nbytes,

				"phys_base=0x%pa ",

				&entry->phys_base);

		} else {

			nbytes += scnprintf(

				dbg_buff + nbytes,

				IPA_MAX_MSG_LEN - nbytes,

				IPA_MAX_MSG_LEN - 1 - nbytes,

				"ofst=%u ",

				entry->offset_entry->offset >> 2);

		}

		for (i = 0; i < entry->hdr_len; i++) {

			scnprintf(dbg_buff + nbytes + i * 2,

				  IPA_MAX_MSG_LEN - nbytes - i * 2,

				  IPA_MAX_MSG_LEN - 1 - nbytes - i * 2,

				  "%02x", entry->hdr[i]);

		}

		scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,

			  IPA_MAX_MSG_LEN - nbytes - entry->hdr_len * 2,

			  IPA_MAX_MSG_LEN - 1 - nbytes - entry->hdr_len * 2,

			  "\n");

		pr_err("%s", dbg_buff);

	}

drivers/platform/msm/ipa/ipa_v3/ipa_debugfs.c

+5 −5
Original line number Diff line number Diff line
@@ -358,7 +358,7 @@ static ssize_t ipa3_read_hdr(struct file *file, char __user *ubuf, size_t count, 
			link) {

		nbytes = scnprintf(

			dbg_buff,

			IPA_MAX_MSG_LEN,

			IPA_MAX_MSG_LEN - 1,

			"name:%s len=%d ref=%d partial=%d type=%s ",

			entry->name,

			entry->hdr_len,
@@ -369,23 +369,23 @@ static ssize_t ipa3_read_hdr(struct file *file, char __user *ubuf, size_t count, 
		if (entry->is_hdr_proc_ctx) {

			nbytes += scnprintf(

				dbg_buff + nbytes,

				IPA_MAX_MSG_LEN - nbytes,

				IPA_MAX_MSG_LEN - 1 - nbytes,

				"phys_base=0x%pa ",

				&entry->phys_base);

		} else {

			nbytes += scnprintf(

				dbg_buff + nbytes,

				IPA_MAX_MSG_LEN - nbytes,

				IPA_MAX_MSG_LEN - 1 - nbytes,

				"ofst=%u ",

				entry->offset_entry->offset >> 2);

		}

		for (i = 0; i < entry->hdr_len; i++) {

			scnprintf(dbg_buff + nbytes + i * 2,

				  IPA_MAX_MSG_LEN - nbytes - i * 2,

				  IPA_MAX_MSG_LEN - 1 - nbytes - i * 2,

				  "%02x", entry->hdr[i]);

		}

		scnprintf(dbg_buff + nbytes + entry->hdr_len * 2,

			  IPA_MAX_MSG_LEN - nbytes - entry->hdr_len * 2,

			  IPA_MAX_MSG_LEN - 1 - nbytes - entry->hdr_len * 2,

			  "\n");

		pr_err("%s", dbg_buff);

	}