msm: pmic: Fix transmit buffer overflow
pmic_buf_reserve() API should have kept the accounting of
length in the pmic_buf structure instead of pmic_rpc_req_reply()
in-order to avoid the overflow for the cases in the
the pmic_rpc_set_struct() API where size is more than
212 bytes.
CRs-Fixed: 294864
Signed-off-by: Trilok Soni <tsoni@codeaurora.org>
diff --git a/arch/arm/mach-msm/pmic.c b/arch/arm/mach-msm/pmic.c
index 6227a78..8101ed5 100644
--- a/arch/arm/mach-msm/pmic.c
+++ b/arch/arm/mach-msm/pmic.c
@@ -232,6 +232,7 @@
static inline void pmic_buf_reserve(struct pmic_buf *bp, int len)
{
bp->data += len;
+ bp->len += len;
}
static inline void pmic_buf_reset(struct pmic_buf *bp)
@@ -359,7 +360,6 @@
* the length
*/
tbuf->data = tbuf->start;
- tbuf->len += sizeof(struct rpc_request_hdr);
len = msm_rpc_call_reply(pm->endpoint, proc,
tbuf->data, tbuf->len,