Merge "spcom: check user space command size" (c8762173) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/soc/qcom/spcom.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -1563,6 +1563,12 @@ static int spcom_handle_lock_ion_buf_command(struct spcom_channel *ch,
		struct ion_handle *ion_handle;
		int i;

		if (size != sizeof(*cmd)) {
		pr_err("cmd size [%d] , expected [%d].\n",
		(int) size, (int) sizeof(*cmd));
		return -EINVAL;
		}

		/* Check ION client */
		if (spcom_dev->ion_client == NULL) {
		pr_err("invalid ion client.\n");
		@@ -1610,6 +1616,12 @@ static int spcom_handle_unlock_ion_buf_command(struct spcom_channel *ch,
		struct ion_client *ion_client = spcom_dev->ion_client;
		int i;

		if (size != sizeof(*cmd)) {
		pr_err("cmd size [%d] , expected [%d].\n",
		(int) size, (int) sizeof(*cmd));
		return -EINVAL;
		}

		/* Check ION client */
		if (ion_client == NULL) {
		pr_err("fail to create ion client.\n");