Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 066f950c authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

greybus: uart: add max-payload sanity check 



Let's be well behaved and add a sanity check on the maximum greybus
payload size to avoid underflow on the calculated buffer size.

Reviewed-by: default avatarRui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Reviewed-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent 71f6c323

drivers/staging/greybus/uart.c

+8 −2
Original line number Diff line number Diff line
@@ -587,6 +587,7 @@ static void gb_tty_exit(void); 


static int gb_uart_connection_init(struct gb_connection *connection)

{

	size_t max_payload;

	struct gb_tty *gb_tty;

	struct device *tty_dev;

	int retval;
@@ -607,8 +608,13 @@ static int gb_uart_connection_init(struct gb_connection *connection) 
		goto error_alloc;

	}



	gb_tty->buffer_payload_max =

		gb_operation_get_payload_size_max(connection) -

	max_payload = gb_operation_get_payload_size_max(connection);

	if (max_payload < sizeof(struct gb_uart_send_data_request)) {

		retval = -EINVAL;

		goto error_payload;

	}



	gb_tty->buffer_payload_max = max_payload -

			sizeof(struct gb_uart_send_data_request);



	gb_tty->buffer = kzalloc(gb_tty->buffer_payload_max, GFP_KERNEL);