mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
69 lines
2.0 KiB
Diff
69 lines
2.0 KiB
Diff
|
From 3823f0f8d0bbbbd675a42a54691f4051b3c7e544 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Sathish Ambley <sathishambley@codeaurora.org>
|
||
|
|
Date: Wed, 25 Jan 2017 10:51:55 -0800
|
||
|
|
Subject: msm: ADSPRPC: Check for buffer overflow condition
|
||
|
|
|
||
|
|
The buffer length that is being passed could result in overflow
|
||
|
|
condition causing invalid memory to be accessed.
|
||
|
|
|
||
|
|
Change-Id: I3e23f31b8cb61f8e77d09a39fab4a2d4c222cf25
|
||
|
|
Signed-off-by: Sathish Ambley <sathishambley@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/char/adsprpc.c | 18 ++++++++++++++----
|
||
|
|
1 file changed, 14 insertions(+), 4 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
|
||
|
|
index 95dca75..b8be20c 100644
|
||
|
|
--- a/drivers/char/adsprpc.c
|
||
|
|
+++ b/drivers/char/adsprpc.c
|
||
|
|
@@ -805,9 +805,9 @@ static int overlap_ptr_cmp(const void *a, const void *b)
|
||
|
|
return st == 0 ? ed : st;
|
||
|
|
}
|
||
|
|
|
||
|
|
-static void context_build_overlap(struct smq_invoke_ctx *ctx)
|
||
|
|
+static int context_build_overlap(struct smq_invoke_ctx *ctx)
|
||
|
|
{
|
||
|
|
- int i;
|
||
|
|
+ int i, err = 0;
|
||
|
|
remote_arg_t *lpra = ctx->lpra;
|
||
|
|
int inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);
|
||
|
|
int outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
|
||
|
|
@@ -816,6 +816,11 @@ static void context_build_overlap(struct smq_invoke_ctx *ctx)
|
||
|
|
for (i = 0; i < nbufs; ++i) {
|
||
|
|
ctx->overs[i].start = (uintptr_t)lpra[i].buf.pv;
|
||
|
|
ctx->overs[i].end = ctx->overs[i].start + lpra[i].buf.len;
|
||
|
|
+ if (lpra[i].buf.len) {
|
||
|
|
+ VERIFY(err, ctx->overs[i].end > ctx->overs[i].start);
|
||
|
|
+ if (err)
|
||
|
|
+ goto bail;
|
||
|
|
+ }
|
||
|
|
ctx->overs[i].raix = i;
|
||
|
|
ctx->overps[i] = &ctx->overs[i];
|
||
|
|
}
|
||
|
|
@@ -841,6 +846,8 @@ static void context_build_overlap(struct smq_invoke_ctx *ctx)
|
||
|
|
max = *ctx->overps[i];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
+bail:
|
||
|
|
+ return err;
|
||
|
|
}
|
||
|
|
|
||
|
|
#define K_COPY_FROM_USER(err, kernel, dst, src, size) \
|
||
|
|
@@ -913,8 +920,11 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel,
|
||
|
|
}
|
||
|
|
|
||
|
|
ctx->sc = invoke->sc;
|
||
|
|
- if (bufs)
|
||
|
|
- context_build_overlap(ctx);
|
||
|
|
+ if (bufs) {
|
||
|
|
+ VERIFY(err, 0 == context_build_overlap(ctx));
|
||
|
|
+ if (err)
|
||
|
|
+ goto bail;
|
||
|
|
+ }
|
||
|
|
ctx->retval = -1;
|
||
|
|
ctx->pid = current->pid;
|
||
|
|
ctx->tgid = current->tgid;
|
||
|
|
--
|
||
|
|
cgit v1.1
|
||
|
|
|