Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 41afa1a9 authored by Hariprasad Dhalinarasimha's avatar Hariprasad Dhalinarasimha
Browse files

qseecom: Check input buffer from IOCTL 



IOCTL messages come with pointers to buffer, check these
buffer pointers prior to accessing it.

Change-Id: Ibd724a35682a6f8e4f6900c8404854a8b55c0c9a
Signed-off-by: default avatarHariprasad Dhalinarasimha <hnamgund@codeaurora.org>
parent 0dcf4ed8

drivers/misc/qseecom.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -1035,6 +1035,11 @@ int __qseecom_process_rpmb_svc_cmd(struct qseecom_dev_handle *data_ptr, 
		return -EINVAL;

		return -EINVAL;

	}

	}





	if ((!req_ptr->cmd_req_buf) || (!req_ptr->resp_buf)) {

		pr_err("Invalid req/resp buffer, exiting\n");

		return -EINVAL;

	}



	if (((uint32_t)req_ptr->cmd_req_buf <

	if (((uint32_t)req_ptr->cmd_req_buf <

			data_ptr->client.user_virt_sb_base)

			data_ptr->client.user_virt_sb_base)

			|| ((uint32_t)req_ptr->cmd_req_buf >=

			|| ((uint32_t)req_ptr->cmd_req_buf >=