Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43e6938f authored by Mahesh Sivasubramanian's avatar Mahesh Sivasubramanian Committed by Gerrit - the friendly Code Review server
Browse files

msm: thermal: Add range checking for cluster_id 



The cluster id flag is passed in from the userspace through ioctl
interface. Ensure correctness of cluster id to avoid out of bounds array
accesses.

CRS-fixed: 977508
Change-Id: I778b962d347b90488b983a15087b13e90ad06688
Signed-off-by: default avatarMahesh Sivasubramanian <msivasub@codeaurora.org>
parent 676c9bc2

drivers/thermal/msm_thermal-dev.c

+7 −1
Original line number Diff line number Diff line 
/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -114,6 +114,9 @@ static long msm_thermal_process_freq_table_req(struct msm_thermal_ioctl *query, 
	uint32_t table_idx, idx = 0, cluster_id = query->clock_freq.cluster_num;

	struct clock_plan_arg *clock_freq = &(query->clock_freq);



	if (cluster_id >= num_possible_cpus())

		return -EINVAL;



	if (!freq_table_len[cluster_id]) {

		ret = msm_thermal_get_freq_plan_size(cluster_id,

			&freq_table_len[cluster_id]);
@@ -200,6 +203,9 @@ static long msm_thermal_process_voltage_table_req( 
	uint32_t cluster_id = query->voltage.cluster_num;

	struct voltage_plan_arg *voltage = &(query->voltage);



	if (cluster_id >= num_possible_cpus())

		return -EINVAL;



	if (!voltage_table_ptr[cluster_id]) {

		if (!freq_table_len[cluster_id]) {

			ret = msm_thermal_get_freq_plan_size(cluster_id,