evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

soc: qcom: scm: add check to avoid buffer overflow

Browse source 
There is a posibility of a buffer overflow in scm_call,
add check to avoid the same.

Change-Id: Iee908c56ec530569b35dafa060139e0428efc781
Signed-off-by: Satya Durga Srinivasu Prabhala <satyap@codeaurora.org>
This commit is contained in:
Satya Durga Srinivasu Prabhala 2016-10-25 16:35:23 -07:00
parent 9b370b3988
commit 01b2c9a5d7
1 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
drivers/soc/qcom/scm.c
View file

@ -56,9 +56,16 @@ DEFINE_MUTEX(scm_lmh_lock);
#define SMC_ATOMIC_MASK 0x80000000
#define IS_CALL_AVAIL_CMD 1
#define SCM_BUF_LEN(__cmd_size, __resp_size) \
(sizeof(struct scm_command) + sizeof(struct scm_response) + \
__cmd_size + __resp_size)
#define SCM_BUF_LEN(__cmd_size, __resp_size) ({ \
size_t x = __cmd_size + __resp_size; \
size_t y = sizeof(struct scm_command) + sizeof(struct scm_response); \
size_t result; \
if (x < __cmd_size || (x + y) < x) \
result = 0; \
else \
result = x + y; \
result; \
})
/**
* struct scm_command - one SCM command buffer
* @len: total available memory for command and response
@ -356,8 +363,7 @@ int scm_call_noalloc(u32 svc_id, u32 cmd_id, const void *cmd_buf,
int ret;
size_t len = SCM_BUF_LEN(cmd_len, resp_len);
if (cmd_len > scm_buf_len || resp_len > scm_buf_len ||
len > scm_buf_len)
if (len == 0)
return -EINVAL;
if (!IS_ALIGNED((unsigned long)scm_buf, PAGE_SIZE))
@ -780,7 +786,7 @@ int scm_call(u32 svc_id, u32 cmd_id, const void *cmd_buf, size_t cmd_len,
int ret;
size_t len = SCM_BUF_LEN(cmd_len, resp_len);
if (cmd_len > len || resp_len > len)
if (len == 0 || PAGE_ALIGN(len) < len)
return -EINVAL;
cmd = kzalloc(PAGE_ALIGN(len), GFP_KERNEL);