Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4df87d2e authored by Prerna Kalla's avatar Prerna Kalla Committed by Gerrit - the friendly Code Review server
Browse files

crypto: msm: restrict value of num_fds to QCEDEV_MAX_BUFFERS 



Set the max value of num_fds to QCEDEV_MAX_BUFFERS to prevent
out of bound access of fd, fd_size, fd_offset array.

Change-Id: I88889472a4bd14f786588bd2c9e06e69a98e94c9
Signed-off-by: default avatarPrerna Kalla <prernak@codeaurora.org>
parent 10da9faf

drivers/crypto/msm/qcedev.c

+6 −1
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ 
/*

 * QTI CE device driver.

 *

 * Copyright (c) 2010-2019, The Linux Foundation. All rights reserved.

 * Copyright (c) 2010-2020, The Linux Foundation. All rights reserved.

 */



#include <linux/mman.h>
@@ -1935,6 +1935,11 @@ static inline long qcedev_ioctl(struct file *file, 
				goto exit_free_qcedev_areq;

			}



			if (map_buf.num_fds > QCEDEV_MAX_BUFFERS) {

				err = -EINVAL;

				goto exit_free_qcedev_areq;

			}



			for (i = 0; i < map_buf.num_fds; i++) {

				err = qcedev_check_and_map_buffer(handle,

						map_buf.fd[i],