Merge "msm-3.18: drivers : added validation of input/output buffer sizes" (a3c6f163) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/misc/qseecom.c

+5 −1

Original line number	Original line	Diff line number	Diff line
	@@ -80,6 +80,9 @@
	/* Encrypt/Decrypt Data Integrity Partition (DIP) for MDTP */		/* Encrypt/Decrypt Data Integrity Partition (DIP) for MDTP */
	#define SCM_MDTP_CIPHER_DIP 0x01		#define SCM_MDTP_CIPHER_DIP 0x01

			/* Maximum Allowed Size (128K) of Data Integrity Partition (DIP) for MDTP */
			#define MAX_DIP 0x20000

	#define RPMB_SERVICE 0x2000		#define RPMB_SERVICE 0x2000
	#define SSD_SERVICE 0x3000		#define SSD_SERVICE 0x3000

	@@ -6029,7 +6032,8 @@ static int qseecom_mdtp_cipher_dip(void __user *argp)
	}		}

	if (req.in_buf == NULL \|\| req.out_buf == NULL \|\|		if (req.in_buf == NULL \|\| req.out_buf == NULL \|\|
	req.in_buf_size == 0 \|\| req.out_buf_size == 0 \|\|		req.in_buf_size == 0 \|\| req.in_buf_size > MAX_DIP \|\|
			req.out_buf_size == 0 \|\| req.out_buf_size > MAX_DIP \|\|
	req.direction > 1) {		req.direction > 1) {
	pr_err("invalid parameters\n");		pr_err("invalid parameters\n");
	ret = -EINVAL;		ret = -EINVAL;