diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2016-08-18 12:04:30 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-08-18 12:04:30 -0700 |
| commit | 480a4a9819b10b980be895e1016d6e8d97cf7bde (patch) | |
| tree | b13ef9a62c56bf99c406650444abb691a67344de | |
| parent | 114e6c72ee190749174a6bf65279d04f0d103274 (diff) | |
| parent | 35d6724310c2672940dc18ea5049dd5ba6c587d8 (diff) | |
Merge "ion: system_secure_heap: Add additional argument verification for ioctl"
| -rw-r--r-- | drivers/staging/android/ion/ion_system_secure_heap.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/staging/android/ion/ion_system_secure_heap.c b/drivers/staging/android/ion/ion_system_secure_heap.c index d519a0937a9f..489c84a39dde 100644 --- a/drivers/staging/android/ion/ion_system_secure_heap.c +++ b/drivers/staging/android/ion/ion_system_secure_heap.c @@ -202,6 +202,9 @@ static int alloc_prefetch_info( if (!is_secure_vmid_valid(get_secure_vmid(vmid))) return -EINVAL; + if (nr_sizes > 0x10) + return -EINVAL; + for (i = 0; i < nr_sizes; i++) { info = kzalloc(sizeof(*info), GFP_KERNEL); if (!info) @@ -235,6 +238,9 @@ int ion_system_secure_heap_prefetch(struct ion_heap *heap, void *ptr) if ((int)heap->type != ION_HEAP_TYPE_SYSTEM_SECURE) return -EINVAL; + if (data->nr_regions > 0x10) + return -EINVAL; + for (i = 0; i < data->nr_regions; i++) { ret = alloc_prefetch_info(&data->regions[i], &items); if (ret) |