mirror of
https://github.com/torvalds/linux.git
synced 2026-09-14 16:10:02 +02:00
d6c075f797
In encode_message() the per-transaction lower-bound check compares
trans_hdr->len against sizeof(trans_hdr), i.e. the size of the pointer,
instead of sizeof(*trans_hdr), the size of struct qaic_manage_trans_hdr.
Every other length check in this file (encode_message() at the loop
guard, decode_message(), etc.) correctly uses sizeof(*trans_hdr), so
this is an inconsistency. On 64-bit builds the pointer and the struct
are both 8 bytes, so the check is correct by coincidence and there is
no behavioural change. On 32-bit builds the pointer is 4 bytes, which
weakens the minimum-length check below the 8-byte header size.
Use sizeof(*trans_hdr) so the check validates against the actual
transaction header size on all builds.
Fixes:
|
||
|---|---|---|
| .. | ||
| amdxdna | ||
| ethosu | ||
| habanalabs | ||
| ivpu | ||
| qaic | ||
| rocket | ||
| drm_accel.c | ||
| Kconfig | ||
| Makefile | ||