Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6927e2e0 authored by Josh Kirsch's avatar Josh Kirsch Committed by Gerrit - the friendly Code Review server
Browse files

drivers: soc: Add buffer overflow check for svc send request 



Add buffer overflow check in voice_svc_send_req.

CRs-fixed: 1010081
Change-Id: I4ae703334b0cf04f327b392bc9cd6febd4ad32f2
Signed-off-by: default avatarJosh Kirsch <jkirsch@codeaurora.org>
parent 0c3a23a4

drivers/soc/qcom/qdsp6v2/voice_svc.c

+32 −14
Original line number Diff line number Diff line 
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -188,7 +188,8 @@ static int voice_svc_send_req(struct voice_svc_cmd_request *apr_request, 
	int ret = 0;

	void *apr_handle = NULL;

	struct apr_data *aprdata = NULL;

	uint32_t user_payload_size = 0;

	uint32_t user_payload_size;

	uint32_t payload_size;



	pr_debug("%s\n", __func__);
@@ -200,16 +201,20 @@ static int voice_svc_send_req(struct voice_svc_cmd_request *apr_request, 
	}



	user_payload_size = apr_request->payload_size;

	payload_size = sizeof(struct apr_data) + user_payload_size;



	aprdata = kmalloc(sizeof(struct apr_data) + user_payload_size,

			  GFP_KERNEL);



	if (payload_size <= user_payload_size) {

		pr_err("%s: invalid payload size ( 0x%x ).\n",

			__func__, user_payload_size);

		ret = -EINVAL;

		goto done;

	} else {

		aprdata = kmalloc(payload_size, GFP_KERNEL);

		if (aprdata == NULL) {

		pr_err("%s: aprdata kmalloc failed.\n", __func__);



			ret = -ENOMEM;

			goto done;

		}

	}



	voice_svc_update_hdr(apr_request, aprdata);
@@ -388,18 +393,31 @@ static ssize_t voice_svc_write(struct file *file, const char __user *buf, 


	switch (cmd) {

	case MSG_REGISTER:

		if (count  >=

				(sizeof(struct voice_svc_register) +

				sizeof(*data))) {

			ret = process_reg_cmd(

			(struct voice_svc_register *)data->payload, prtd);

			if (!ret)

				ret = count;



		} else {

			pr_err("%s: invalid payload size\n", __func__);

			ret = -EINVAL;

			goto done;

		}

		break;

	case MSG_REQUEST:

	if (count >= (sizeof(struct voice_svc_cmd_request) +

					sizeof(*data))) {

		ret = voice_svc_send_req(

			(struct voice_svc_cmd_request *)data->payload, prtd);

		if (!ret)

			ret = count;



	} else {

		pr_err("%s: invalid payload size\n", __func__);

		ret = -EINVAL;

		goto done;

	}

		break;

	default:

		pr_debug("%s: Invalid command: %u\n", __func__, cmd);