diff options
| author | Alex Shi <alex.shi@linaro.org> | 2016-08-18 12:33:31 +0800 |
|---|---|---|
| committer | Alex Shi <alex.shi@linaro.org> | 2016-08-18 12:33:31 +0800 |
| commit | fdd85431d91c9da37e9e696eb8fe80f1a2dcdbeb (patch) | |
| tree | ac60b28ebed345df274ce42aa3c9f3ee091875d1 /arch/arm/kernel | |
| parent | e01035c1a71d7cceebc3df92f79577df7438523a (diff) | |
| parent | e779279da78339ec75fa72571ef901a447762cc6 (diff) | |
Merge branch 'linux-linaro-lsk-v4.4' into linux-linaro-lsk-v4.4-android
Diffstat (limited to 'arch/arm/kernel')
| -rw-r--r-- | arch/arm/kernel/sys_oabi-compat.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c index 087acb569b63..5f221acd21ae 100644 --- a/arch/arm/kernel/sys_oabi-compat.c +++ b/arch/arm/kernel/sys_oabi-compat.c @@ -279,8 +279,12 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, mm_segment_t fs; long ret, err, i; - if (maxevents <= 0 || maxevents > (INT_MAX/sizeof(struct epoll_event))) + if (maxevents <= 0 || + maxevents > (INT_MAX/sizeof(*kbuf)) || + maxevents > (INT_MAX/sizeof(*events))) return -EINVAL; + if (!access_ok(VERIFY_WRITE, events, sizeof(*events) * maxevents)) + return -EFAULT; kbuf = kmalloc(sizeof(*kbuf) * maxevents, GFP_KERNEL); if (!kbuf) return -ENOMEM; @@ -317,6 +321,8 @@ asmlinkage long sys_oabi_semtimedop(int semid, if (nsops < 1 || nsops > SEMOPM) return -EINVAL; + if (!access_ok(VERIFY_READ, tsops, sizeof(*tsops) * nsops)) + return -EFAULT; sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL); if (!sops) return -ENOMEM; |