Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e65a876a authored by Mona Hossain's avatar Mona Hossain
Browse files

qseecom: Validate inputs from user space 



Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: default avatarMona Hossain <mhossain@codeaurora.org>
parent d6e87cbf

drivers/misc/qseecom.c

+33 −2
Original line number Diff line number Diff line
@@ -1134,9 +1134,22 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, 
		pr_err("cmd buffer or response buffer is null\n");

		return -EINVAL;

	}

	if (((uint32_t)req->cmd_req_buf < data->client.user_virt_sb_base) ||

		((uint32_t)req->cmd_req_buf >= (data->client.user_virt_sb_base +

					data->client.sb_length))) {

		pr_err("cmd buffer address not within shared bufffer\n");

		return -EINVAL;

	}





	if (((uint32_t)req->resp_buf < data->client.user_virt_sb_base)  ||

		((uint32_t)req->resp_buf >= (data->client.user_virt_sb_base +

					data->client.sb_length))){

		pr_err("response buffer address not within shared bufffer\n");

		return -EINVAL;

	}



	if (req->cmd_req_len <= 0 ||

		req->resp_len <= 0 ||

	if ((req->cmd_req_len == 0) || (req->resp_len == 0) ||

		req->cmd_req_len > data->client.sb_length ||

		req->resp_len > data->client.sb_length) {

		pr_err("cmd buffer length or "
@@ -1371,6 +1384,7 @@ static int qseecom_send_modfd_cmd(struct qseecom_dev_handle *data, 
					void __user *argp)

{

	int ret = 0;

	int i;

	struct qseecom_send_modfd_cmd_req req;

	struct qseecom_send_cmd_req send_cmd_req;
@@ -1384,6 +1398,14 @@ static int qseecom_send_modfd_cmd(struct qseecom_dev_handle *data, 
	send_cmd_req.resp_buf = req.resp_buf;

	send_cmd_req.resp_len = req.resp_len;



	/* validate offsets */

	for (i = 0; i < MAX_ION_FD; i++) {

		if (req.ifd_data[i].cmd_buf_offset >= req.cmd_req_len) {

			pr_err("Invalid offset %d = 0x%x\n",

				i, req.ifd_data[i].cmd_buf_offset);

			return -EINVAL;

		}

	}

	ret = __qseecom_update_cmd_buf(&req, false, data, false);

	if (ret)

		return ret;
@@ -2001,11 +2023,20 @@ static int qseecom_send_modfd_resp(struct qseecom_dev_handle *data, 
						void __user *argp)

{

	struct qseecom_send_modfd_listener_resp resp;

	int i;



	if (copy_from_user(&resp, argp, sizeof(resp))) {

		pr_err("copy_from_user failed");

		return -EINVAL;

	}

	/* validate offsets */

	for (i = 0; i < MAX_ION_FD; i++) {

		if (resp.ifd_data[i].cmd_buf_offset >= resp.resp_len) {

			pr_err("Invalid offset %d = 0x%x\n",

				i, resp.ifd_data[i].cmd_buf_offset);

			return -EINVAL;

		}

	}

	__qseecom_update_cmd_buf(&resp, false, data, true);

	qseecom.send_resp_flag = 1;

	wake_up_interruptible(&qseecom.send_resp_wq);