diff options
| author | Yuanyuan Liu <yuanliu@codeaurora.org> | 2017-09-01 10:34:25 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-01-09 17:04:11 -0800 |
| commit | d49bcf2440ba95e3af6d58cf854189e8c1376dea (patch) | |
| tree | 064126b39e3fe0bbbcd1bd4f15780e40195fdb61 | |
| parent | 55cc722ec6725f7547071a396606f6a04b9a75e8 (diff) | |
icnss: Add size check before assigning msa permission
While assigning msa permission, number of memory region is passed
as an argument within platform private data. This number could
exceed the range of memory region buffer that preallocated. Hence
add size check before accessing region buffer.
Change-Id: I45f4efc7edaa636c861458dab74b1956767d2019
CRs-Fixed: 2101134
Signed-off-by: Yuanyuan Liu <yuanliu@codeaurora.org>
| -rw-r--r-- | drivers/soc/qcom/icnss.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/soc/qcom/icnss.c b/drivers/soc/qcom/icnss.c index 4ec3b6762cfd..7f71824d9548 100644 --- a/drivers/soc/qcom/icnss.c +++ b/drivers/soc/qcom/icnss.c @@ -563,6 +563,12 @@ static int icnss_assign_msa_perm_all(struct icnss_priv *priv, int i; enum icnss_msa_perm old_perm; + if (priv->nr_mem_region > QMI_WLFW_MAX_NUM_MEMORY_REGIONS_V01) { + icnss_pr_err("Invalid memory region len %d\n", + priv->nr_mem_region); + return -EINVAL; + } + for (i = 0; i < priv->nr_mem_region; i++) { old_perm = priv->mem_region[i].perm; ret = icnss_assign_msa_perm(&priv->mem_region[i], new_perm); |