Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ef2a35e4 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "qseecom: Validate the incoming length from user space"

parents 2dcec40f 5f609d48

drivers/misc/qseecom.c

+6 −1
Original line number Diff line number Diff line
@@ -1167,6 +1167,11 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, 
		return -EINVAL;

	}



	if (req->cmd_req_len > UINT_MAX - req->resp_len) {

		pr_err("Integer overflow detected in req_len & rsp_len, exiting now\n");

		return -EINVAL;

	}



	reqd_len_sb_in = req->cmd_req_len + req->resp_len;

	if (reqd_len_sb_in > data->client.sb_length) {

		pr_debug("Not enough memory to fit cmd_buf and "
@@ -1186,7 +1191,7 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, 


	msm_ion_do_cache_op(qseecom.ion_clnt, data->client.ihandle,

					data->client.sb_virt,

					(req->cmd_req_len + req->resp_len),

					reqd_len_sb_in,

					ION_IOC_CLEAN_INV_CACHES);



	ret = scm_call(SCM_SVC_TZSCHEDULER, 1, (const void *) &send_data_req,