Messages in this thread | | | Subject | Re: [PATCH v4 4/8] bus: mhi: core: Read transfer length from an event properly | From | Jeffrey Hugo <> | Date | Mon, 4 May 2020 08:31:25 -0600 |
| |
On 5/1/2020 8:32 PM, Bhaumik Bhatt wrote: > From: Hemant Kumar <hemantk@codeaurora.org> > > When MHI Driver receives an EOT event, it reads xfer_len from the > event in the last TRE. The value is under control of the MHI device > and never validated by Host MHI driver. The value should never be > larger than the real size of the buffer but a malicious device can > set the value 0xFFFF as maximum. This causes driver to memory > overflow (both read or write). Fix this issue by reading minimum of > transfer length from event and the buffer length provided. > > Signed-off-by: Hemant Kumar <hemantk@codeaurora.org> > Signed-off-by: Bhaumik Bhatt <bbhatt@codeaurora.org>
Reviewed-by: Jeffrey Hugo <jhugo@codeaurora.org>
-- Jeffrey Hugo Qualcomm Technologies, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project.
| |