diff options
| -rw-r--r-- | drivers/soc/google/cpif/link_rx_pktproc.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/soc/google/cpif/link_rx_pktproc.c b/drivers/soc/google/cpif/link_rx_pktproc.c index 8768b718b759..db5e736a3667 100644 --- a/drivers/soc/google/cpif/link_rx_pktproc.c +++ b/drivers/soc/google/cpif/link_rx_pktproc.c @@ -414,6 +414,14 @@ static int pktproc_fill_data_addr_without_bm(struct pktproc_queue *q) fore = *q->fore_ptr; #endif + /* The fore pointer is passed by CP from shared memory. Check the + * range to avoid OOB access */ + if ((fore < 0) || (fore >= q->num_desc)) { + mif_err("Invalid fore_ptr (%d) passed by CP on queue(%d)!\n", + fore, q->q_idx); + return -EINVAL; + } + pp_debug("Q%d:%d/%d/%d\n", q->q_idx, fore, *q->rear_ptr, q->done_ptr); |