From 96eca370719871e5e3f65a62bd9f0d37cb389432 Mon Sep 17 00:00:00 2001 From: Manoj Prabhu B Date: Wed, 24 Apr 2019 21:11:06 +0530 Subject: [PATCH] diag: Check command size against the minimum before parsing Add check for minimum length before typecasting to build mask structure to prevent out of bound access while processing get msg mask command. CRs-Fixed: 2431047 Change-Id: I5b8341f278b0b46359800e43c604c5671261c728 Signed-off-by: Manoj Prabhu B --- drivers/char/diag/diag_masks.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index bb28958412ed..438f33d8cadb 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2008-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -705,7 +705,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &msg_mask : info->msg_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || - !mask_info) { + !mask_info || (src_len < sizeof(struct diag_build_mask_req_t))) { pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info);