evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "usb: pd: Avoid buffer overrun during msg_rx"

Browse source
This commit is contained in:
Linux Build Service Account 2017-02-27 15:16:29 -08:00 • committed by Gerrit - the friendly Code Review server
commit 17de1566e1
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/usb/pd/policy_engine.c
View file

@ -665,7 +665,7 @@ static void phy_msg_received(struct usbpd *pd, enum pd_msg_type type,
rx_msg->type = PD_MSG_HDR_TYPE(header); rx_msg->type = PD_MSG_HDR_TYPE(header);
rx_msg->len = PD_MSG_HDR_COUNT(header); rx_msg->len = PD_MSG_HDR_COUNT(header);
memcpy(&rx_msg->payload, buf, len); memcpy(&rx_msg->payload, buf, min(len, sizeof(rx_msg->payload)));
spin_lock_irqsave(&pd->rx_lock, flags); spin_lock_irqsave(&pd->rx_lock, flags);
list_add_tail(&rx_msg->entry, &pd->rx_q); list_add_tail(&rx_msg->entry, &pd->rx_q);