diff options
| author |   Tzung-Bi Shih <tzungbi@kernel.org> | 2022-05-13 12:41:39 +0800 |
|---|---|---|
| committer | Tzung-Bi Shih <tzungbi@kernel.org> | 2022-05-16 10:01:51 +0800 |
| commit | c2dcb1b06053a1ccfb73fe84e7b54b92383401cc (patch) | |
| tree | 253e28cb483fe1b1977ddc27c5381a1728de3119 /drivers/platform | |
| parent | platform/chrome: correct cros_ec_prepare_tx() usage (diff) | |
| download | linux-dev-c2dcb1b06053a1ccfb73fe84e7b54b92383401cc.tar.xz linux-dev-c2dcb1b06053a1ccfb73fe84e7b54b92383401cc.zip | |
platform/chrome: cros_ec_proto: drop BUG_ON() in cros_ec_prepare_tx()
It is overkill to crash the kernel if the given message is oversize.
Drop the BUG_ON() and return -EINVAL instead.
Reviewed-by: Guenter Roeck <groeck@chromium.org>
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://lore.kernel.org/r/20220513044143.1045728-4-tzungbi@kernel.org
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/chrome/cros_ec_proto.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c index 2d6d3fbfa905..9ce3374846ff 100644 --- a/drivers/platform/chrome/cros_ec_proto.c +++ b/drivers/platform/chrome/cros_ec_proto.c @@ -60,7 +60,8 @@ static int prepare_packet(struct cros_ec_device *ec_dev, int i; u8 csum = 0; - BUG_ON(msg->outsize + sizeof(*request) > ec_dev->dout_size); + if (msg->outsize + sizeof(*request) > ec_dev->dout_size) + return -EINVAL; out = ec_dev->dout; request = (struct ec_host_request *)out; @@ -176,7 +177,9 @@ int cros_ec_prepare_tx(struct cros_ec_device *ec_dev, if (ec_dev->proto_version > 2) return prepare_packet(ec_dev, msg); - BUG_ON(msg->outsize > EC_PROTO2_MAX_PARAM_SIZE); + if (msg->outsize > EC_PROTO2_MAX_PARAM_SIZE) + return -EINVAL; + out = ec_dev->dout; out[0] = EC_CMD_VERSION0 + msg->version; out[1] = msg->command; |