Commit c95de1ae authored Mar 30, 2020 by Prerna Kalla Committed by Gerrit - the friendly Code Review server Apr 01, 2020

crypto: msm: restrict value of num_fds to QCEDEV_MAX_BUFFERS



Set the max value of num_fds to QCEDEV_MAX_BUFFERS to prevent
out of bound access of fd, fd_size, fd_offset array.

Change-Id: I88889472a4bd14f786588bd2c9e06e69a98e94c9
Signed-off-by: Prerna Kalla <prernak@codeaurora.org>

parent c3faeded

drivers/crypto/msm/qcedev.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1925,6 +1925,11 @@ long qcedev_ioctl(struct file *file,
		goto exit_free_qcedev_areq;
		}

		if (map_buf.num_fds > QCEDEV_MAX_BUFFERS) {
		err = -EINVAL;
		goto exit_free_qcedev_areq;
		}

		for (i = 0; i < map_buf.num_fds; i++) {
		err = qcedev_check_and_map_buffer(handle,
		map_buf.fd[i],