mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-30 13:52:50 +01:00
Youssef Samir
ab243f74ab
Although 'commit2feec5ae5d("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker(). Reported-by: Ruikai Peng <[email protected]> Fixes:2feec5ae5d("accel/qaic: Handle DBC deactivation if the owner went away") Reviewed-by: Jeff Hugo <[email protected]> Reviewed-by: Lizhi Hou <[email protected]> Signed-off-by: Youssef Samir <[email protected]> Signed-off-by: Jeff Hugo <[email protected]> Link: https://patch.msgid.link/[email protected]