diff options
| author | Yajun Li <yajunl@codeaurora.org> | 2018-09-21 18:15:22 +0800 |
|---|---|---|
| committer | Yajun Li <yajunl@codeaurora.org> | 2018-10-12 15:23:11 +0800 |
| commit | 1eaf1fb7f475fe027785f6739a5af0b1aae0a9b6 (patch) | |
| tree | 1e2c197f0a1259347a7fe7b5e9e587d3905f90f5 | |
| parent | 51abefff9fb42c8834acb643d6aa70d855e0cf43 (diff) | |
soc: hab: add size checking when hab import buffer
If the input size of import buffer isn't equal to
the real size of this buffer, hab should reject this
import function.
Change-Id: I184a0752d37e9f1bf6a8705ccf8f2fdfd6796d5e
Signed-off-by: Yajun Li <yajunl@codeaurora.org>
| -rw-r--r-- | drivers/soc/qcom/hab/hab_mimex.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/soc/qcom/hab/hab_mimex.c b/drivers/soc/qcom/hab/hab_mimex.c index 00c6c475fa92..efa4bb383ec6 100644 --- a/drivers/soc/qcom/hab/hab_mimex.c +++ b/drivers/soc/qcom/hab/hab_mimex.c @@ -376,6 +376,13 @@ int hab_mem_import(struct uhab_context *ctx, } spin_unlock_bh(&ctx->imp_lock); + if ((exp->payload_count << PAGE_SHIFT) != param->sizebytes) { + pr_err("input size %d don't match buffer size %d\n", + param->sizebytes, exp->payload_count << PAGE_SHIFT); + ret = -EINVAL; + goto err_imp; + } + if (!found) { pr_err("Fail to get export descriptor from export id %d\n", param->exportid); |