evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

soc: qcom: rpm_master_stat: Fix buffer overflow

Browse source 
Buffer overflow can happen when finding next set bit
due to type casting of uint32_t to unsigned long.

Fix this to correctly print number of active cores in
rpm_master_stat.

Change-Id: Ibeacc5ac66535e373965d8f8e4919829367cc257
Signed-off-by: Maulik Shah <mkshah@codeaurora.org>
This commit is contained in:
Maulik Shah 2017-05-15 10:52:14 +05:30
parent c6d1c1699e
commit a9cab2670f
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/soc/qcom/rpm_master_stat.c
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. /* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
@ -96,6 +96,7 @@ static int msm_rpm_master_copy_stats(
int count, j = 0; int count, j = 0;
char *buf; char *buf;
static DEFINE_MUTEX(msm_rpm_master_stats_mutex); static DEFINE_MUTEX(msm_rpm_master_stats_mutex);
unsigned long active_cores;
mutex_lock(&msm_rpm_master_stats_mutex); mutex_lock(&msm_rpm_master_stats_mutex);
@ -247,12 +248,11 @@ static int msm_rpm_master_copy_stats(
record.active_cores); record.active_cores);
} }
j = find_first_bit((unsigned long *)&record.active_cores, active_cores = record.active_cores;
BITS_PER_LONG); j = find_first_bit(&active_cores, BITS_PER_LONG);
while (j < BITS_PER_LONG) { while (j < BITS_PER_LONG) {
SNPRINTF(buf, count, "\t\tcore%d\n", j); SNPRINTF(buf, count, "\t\tcore%d\n", j);
j = find_next_bit((unsigned long *)&record.active_cores, j = find_next_bit(&active_cores, BITS_PER_LONG, j + 1);
BITS_PER_LONG, j + 1);
} }
master_cnt++; master_cnt++;