From 9c72c5a227e57e3791069f464ae6161dc7d66d41 Mon Sep 17 00:00:00 2001 From: Alan Chen Date: Wed, 21 Dec 2022 17:52:30 -0800 Subject: [PATCH] icnss2: Add data length validation in cnss_wlfw_qdss_data_send_sync() Add a data length validation check in fw response message in qdss_data_send_sync(). Change-Id: I750f46549bc914698baaf4e24f1710536ca8e356 CRs-Fixed: 3366343 Signed-off-by: Alan Chen --- drivers/soc/qcom/icnss2/qmi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/soc/qcom/icnss2/qmi.c b/drivers/soc/qcom/icnss2/qmi.c index 26bbacaa6621..5290daccb276 100644 --- a/drivers/soc/qcom/icnss2/qmi.c +++ b/drivers/soc/qcom/icnss2/qmi.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2017-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. */ #define pr_fmt(fmt) "icnss2_qmi: " fmt @@ -1198,7 +1199,8 @@ int icnss_wlfw_qdss_data_send_sync(struct icnss_priv *priv, char *file_name, resp->total_size == total_size) && (resp->seg_id_valid == 1 && resp->seg_id == req->seg_id) && (resp->data_valid == 1 && - resp->data_len <= QMI_WLFW_MAX_DATA_SIZE_V01)) { + resp->data_len <= QMI_WLFW_MAX_DATA_SIZE_V01) && + resp->data_len <= remaining) { memcpy(p_qdss_trace_data_temp, resp->data, resp->data_len); } else {