lkml.org 
[lkml]   [2018]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.17 112/336] soc: qcom: qmi: fix a buffer sizing bug
    Date
    4.17-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alex Elder <elder@linaro.org>

    [ Upstream commit 7df5ff258bd27900d516fea88da10d05602bf8c7 ]

    In qmi_handle_init(), a buffer is allocated for to hold messages
    received through the handle's socket. Any "normal" messages
    (expected by the caller) will have a header prepended, so the
    buffer size is adjusted to accomodate that.

    The buffer must also be of sufficient size to receive control
    messages, so the size is increased if necessary to ensure these
    will fit.

    Unfortunately the calculation is done wrong, making it possible
    for the calculated buffer size to be too small to hold a "normal"
    message. Specifically, if:

    recv_buf_size > sizeof(struct qrtr_ctrl_pkt) - sizeof(struct qmi_header)
    AND
    recv_buf_size < sizeof(struct qrtr_ctrl_pkt)

    the current logic will use sizeof(struct qrtr_ctrl_pkt) as the
    receive buffer size, which is not enough to hold the maximum
    "normal" message plus its header. Currently this problem occurs
    for (13 < recv_buf_size < 20).

    This patch corrects this.

    Signed-off-by: Alex Elder <elder@linaro.org>
    Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
    Signed-off-by: Andy Gross <andy.gross@linaro.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/soc/qcom/qmi_interface.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/drivers/soc/qcom/qmi_interface.c
    +++ b/drivers/soc/qcom/qmi_interface.c
    @@ -639,10 +639,11 @@ int qmi_handle_init(struct qmi_handle *q
    if (ops)
    qmi->ops = *ops;

    + /* Make room for the header */
    + recv_buf_size += sizeof(struct qmi_header);
    + /* Must also be sufficient to hold a control packet */
    if (recv_buf_size < sizeof(struct qrtr_ctrl_pkt))
    recv_buf_size = sizeof(struct qrtr_ctrl_pkt);
    - else
    - recv_buf_size += sizeof(struct qmi_header);

    qmi->recv_buf_size = recv_buf_size;
    qmi->recv_buf = kzalloc(recv_buf_size, GFP_KERNEL);

    \
     
     \ /
      Last update: 2018-08-01 20:30    [W:2.750 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site