Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a4f3d20 authored by Vijayanand Jitta's avatar Vijayanand Jitta Committed by Gerrit - the friendly Code Review server
Browse files

mem_buf: Validate n_acl_entries 



Validate n_acl_entries specified by the requesting VM.

Limiting n_acl_entries to 1 for now based on the existing check in
mem_buf_alloc().

Change-Id: I802219ada9ee9109d18a42b2a80539d1cbd4df64
Signed-off-by: default avatarVijayanand Jitta <quic_vjitta@quicinc.com>
parent 46ca04c7

drivers/soc/qcom/mem-buf.c

+11 −4
Original line number Diff line number Diff line
@@ -529,12 +529,19 @@ struct mem_buf_xfer_mem *mem_buf_prep_xfer_mem(void *req_msg) 
	int ret;

	struct mem_buf_xfer_mem *xfer_mem;

	struct mem_buf_alloc_req *req = req_msg;

	u32 nr_acl_entries = req->acl_desc.n_acl_entries;

	size_t alloc_req_msg_size = offsetof(struct mem_buf_alloc_req,

					acl_desc.acl_entries[nr_acl_entries]);

	void *arb_payload = req_msg + alloc_req_msg_size;

	u32 nr_acl_entries;

	size_t alloc_req_msg_size;

	void *arb_payload;

	void *mem_type_data;



	nr_acl_entries = req->acl_desc.n_acl_entries;

	if (nr_acl_entries != 1)

		return ERR_PTR(-EINVAL);



	alloc_req_msg_size = offsetof(struct mem_buf_alloc_req,

					acl_desc.acl_entries[nr_acl_entries]);

	arb_payload = req_msg + alloc_req_msg_size;



	xfer_mem = kzalloc(sizeof(*xfer_mem), GFP_KERNEL);

	if (!xfer_mem)

		return ERR_PTR(-ENOMEM);