diff options
author | Linux Build Service Account <lnxbuild@localhost> | 2017-04-21 17:57:35 -0700 |
---|---|---|
committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-04-21 17:57:35 -0700 |
commit | 038de1e53d6f37a1cbb0108e856ad384c0060da8 (patch) | |
tree | 9ce2071b1c8aee21732b60de0eca5a8b9037d6c1 | |
parent | d44796d6aeafe97d8e14da09d16bebcaf0aa0c5b (diff) | |
parent | cae0d5a6f32e52e06c0841bb7142452062dc2ac8 (diff) |
Merge "soc: qcom: pil: Avoid possible buffer overflow during Modem boot"
-rw-r--r-- | drivers/soc/qcom/pil-msa.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/soc/qcom/pil-msa.c b/drivers/soc/qcom/pil-msa.c index 53bddc5987df..988b6e8c9fd9 100644 --- a/drivers/soc/qcom/pil-msa.c +++ b/drivers/soc/qcom/pil-msa.c @@ -616,7 +616,15 @@ int pil_mss_reset_load_mba(struct pil_desc *pil) /* Load the MBA image into memory */ count = fw->size; - memcpy(mba_dp_virt, data, count); + if (count <= SZ_1M) { + /* Ensures memcpy is done for max 1MB fw size */ + memcpy(mba_dp_virt, data, count); + } else { + dev_err(pil->dev, "%s fw image loading into memory is failed due to fw size overflow\n", + __func__); + ret = -EINVAL; + goto err_mba_data; + } /* Ensure memcpy of the MBA memory is done before loading the DP */ wmb(); |