mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-12-20 21:34:24 -05:00
56 lines
2.0 KiB
Diff
56 lines
2.0 KiB
Diff
|
From 67118716a2933f6f30a25ea7e3946569a8b191c6 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Kamal Negi <kamaln@codeaurora.org>
|
||
|
|
Date: Wed, 19 Oct 2016 18:59:11 +0530
|
||
|
|
Subject: radio-iris: check argument values before copying the data
|
||
|
|
|
||
|
|
Check arguments passed in an ioctl before copying the data to kernel
|
||
|
|
buffers. If user sends an erroneous data, data length more than expected,
|
||
|
|
will lead to buffer overflow.
|
||
|
|
|
||
|
|
Change-Id: I663e937806f38dc3b04c8d7662cd8b045facd12b
|
||
|
|
Signed-off-by: Kamal Negi <kamaln@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/media/radio/radio-iris.c | 19 ++++++++++++++++---
|
||
|
|
1 file changed, 16 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/media/radio/radio-iris.c b/drivers/media/radio/radio-iris.c
|
||
|
|
index b3088eb..bd4eb92 100644
|
||
|
|
--- a/drivers/media/radio/radio-iris.c
|
||
|
|
+++ b/drivers/media/radio/radio-iris.c
|
||
|
|
@@ -3884,8 +3884,20 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv,
|
||
|
|
bytes_to_copy = (ctrl->controls[0]).size;
|
||
|
|
spur_tbl_req.mode = data[0];
|
||
|
|
spur_tbl_req.no_of_freqs_entries = data[1];
|
||
|
|
- spur_data = kmalloc((data[1] * SPUR_DATA_LEN) + 2,
|
||
|
|
- GFP_ATOMIC);
|
||
|
|
+
|
||
|
|
+ if (((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN) !=
|
||
|
|
+ bytes_to_copy - 2) ||
|
||
|
|
+ ((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN) >
|
||
|
|
+ 2 * FM_SPUR_TBL_SIZE)) {
|
||
|
|
+ FMDERR("Invalid data len: data[1] = %d, bytes = %zu",
|
||
|
|
+ spur_tbl_req.no_of_freqs_entries,
|
||
|
|
+ bytes_to_copy);
|
||
|
|
+ retval = -EINVAL;
|
||
|
|
+ goto END;
|
||
|
|
+ }
|
||
|
|
+ spur_data =
|
||
|
|
+ kmalloc((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN)
|
||
|
|
+ + 2, GFP_ATOMIC);
|
||
|
|
if (!spur_data) {
|
||
|
|
FMDERR("Allocation failed for Spur data");
|
||
|
|
retval = -EFAULT;
|
||
|
|
@@ -3900,7 +3912,8 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv,
|
||
|
|
|
||
|
|
if (spur_tbl_req.no_of_freqs_entries <= ENTRIES_EACH_CMD) {
|
||
|
|
memcpy(&spur_tbl_req.spur_data[0], spur_data,
|
||
|
|
- (data[1] * SPUR_DATA_LEN));
|
||
|
|
+ (spur_tbl_req.no_of_freqs_entries *
|
||
|
|
+ SPUR_DATA_LEN));
|
||
|
|
retval = radio_hci_request(radio->fm_hdev,
|
||
|
|
hci_fm_set_spur_tbl_req,
|
||
|
|
(unsigned long)&spur_tbl_req,
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|