evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

qseecom: check img_len and mdt_len against ion buf len

Browse source 
Variable "load_img_req.img_len" and "load_img_req.mdt_len" are
from user land, so check their values against ion buf length
to avoid buffer overread on QSEE side.

Change-Id: I9e8bfe32d3b0cd5b441ad724543c56467fa5e4da
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
This commit is contained in:
Zhen Kong 2017-03-20 10:51:32 -07:00
parent 3f942f9f96
commit 9f290f6e79
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/misc/qseecom.c
View file

@ -2333,7 +2333,13 @@ static int qseecom_load_app(struct qseecom_dev_handle *data, void __user *argp)
ret);
goto loadapp_err;
}
if (load_img_req.mdt_len > len || load_img_req.img_len > len) {
pr_err("ion len %zu is smaller than mdt_len %u or img_len %u\n",
len, load_img_req.mdt_len,
load_img_req.img_len);
ret = -EINVAL;
goto loadapp_err;
}
/* Populate the structure for sending scm call to load image */
if (qseecom.qsee_version < QSEE_VERSION_40) {
load_req.qsee_cmd_id = QSEOS_APP_START_COMMAND;
@ -5149,6 +5155,12 @@ static int qseecom_load_external_elf(struct qseecom_dev_handle *data,
ret);
return ret;
}
if (load_img_req.mdt_len > len || load_img_req.img_len > len) {
pr_err("ion len %zu is smaller than mdt_len %u or img_len %u\n",
len, load_img_req.mdt_len,
load_img_req.img_len);
return ret;
}
/* Populate the structure for sending scm call to load image */
if (qseecom.qsee_version < QSEE_VERSION_40) {
load_req.qsee_cmd_id = QSEOS_LOAD_EXTERNAL_ELF_COMMAND;