diff options
| author | Anmolpreet Kaur <anmolpre@codeaurora.org> | 2019-05-02 17:32:08 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-05-26 23:22:34 -0700 |
| commit | fa9dbbba721023e81c14d7f2b78eedf6418f400c (patch) | |
| tree | 19198e7b49d317a2ec40a48e4c35f4f89d98e990 | |
| parent | 547234bc39058092bd09dc38b11081cd357060e9 (diff) | |
qcom: smcinvoke: Fix stack overflow for arr_filp
arr_filp is an alias to filp_to_release. It is exposed
to access indices greater than allotted space of 15 bytes,
equal to size of OBJECT_COUNTS_MAX_OO. This change fixes
the stack overflow by taking an independent variable to track
the number of output objects.
Change-Id: Idca9cef3c69693d27d4ca3d0e0b4845fc27c998a
Signed-off-by: Anmolpreet Kaur <anmolpre@codeaurora.org>
| -rw-r--r-- | drivers/soc/qcom/smcinvoke.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/soc/qcom/smcinvoke.c b/drivers/soc/qcom/smcinvoke.c index f69ff47ae0f7..1d51970df961 100644 --- a/drivers/soc/qcom/smcinvoke.c +++ b/drivers/soc/qcom/smcinvoke.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016-2017,2019 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -302,7 +302,7 @@ static int marshal_in(const struct smcinvoke_cmd_req *req, const union smcinvoke_arg *args_buf, uint32_t tzhandle, uint8_t *buf, size_t buf_size, struct file **arr_filp) { - int ret = -EINVAL, i = 0; + int ret = -EINVAL, i = 0, j = 0; union smcinvoke_tz_args *tz_args = NULL; struct smcinvoke_msg_hdr msg_hdr = {tzhandle, req->op, req->counts}; uint32_t offset = sizeof(struct smcinvoke_msg_hdr) + @@ -347,7 +347,7 @@ static int marshal_in(const struct smcinvoke_cmd_req *req, } FOR_ARGS(i, req->counts, OI) { if (get_tzhandle_from_fd(args_buf[i].o.fd, - &arr_filp[i], &(tz_args->tzhandle))) + &arr_filp[j++], &(tz_args->tzhandle))) goto out; tz_args++; } |