diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2017-02-09 03:11:08 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-02-09 03:11:07 -0800 |
| commit | f487064d899c2b6062f81cb2d85caf7e185cbfd3 (patch) | |
| tree | 054772d0b87d9832e9f3f8754c5b935774863ceb | |
| parent | d24550bbf50f61b07668a28a20878e1f91cf544c (diff) | |
| parent | b1cfb2c899704beddf677e46403d76c46302c425 (diff) | |
Merge "msm: ADSPRPC: Buffer length to be copied is truncated"
| -rw-r--r-- | drivers/char/adsprpc.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 9a7411a33127..0345e977a2d4 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1102,6 +1102,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) /* calculate len requreed for copying */ for (oix = 0; oix < inbufs + outbufs; ++oix) { int i = ctx->overps[oix]->raix; + uintptr_t mstart, mend; ssize_t len = lpra[i].buf.len; if (!len) continue; @@ -1109,7 +1110,15 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) continue; if (ctx->overps[oix]->offset == 0) copylen = ALIGN(copylen, BALIGN); - copylen += ctx->overps[oix]->mend - ctx->overps[oix]->mstart; + mstart = ctx->overps[oix]->mstart; + mend = ctx->overps[oix]->mend; + VERIFY(err, (mend - mstart) <= LONG_MAX); + if (err) + goto bail; + copylen += mend - mstart; + VERIFY(err, copylen >= 0); + if (err) + goto bail; } ctx->used = copylen; @@ -1181,7 +1190,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) for (oix = 0; oix < inbufs + outbufs; ++oix) { int i = ctx->overps[oix]->raix; struct fastrpc_mmap *map = ctx->maps[i]; - int mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart; + ssize_t mlen; uint64_t buf; ssize_t len = lpra[i].buf.len; if (!len) @@ -1192,6 +1201,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) rlen -= ALIGN(args, BALIGN) - args; args = ALIGN(args, BALIGN); } + mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart; VERIFY(err, rlen >= mlen); if (err) goto bail; |