evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

spcom: check user space command size

Browse source 
The user space spcomlib provides command buffer
for various commands.
Verify that the command buffer size matches the expected
command struct size.

CRs-Fixed: 1094143
Change-Id: If3ead54bd03368fa9338921e299b2ad8fb078297
Signed-off-by: Amir Samuelov <amirs@codeaurora.org>
This commit is contained in:
Amir Samuelov 2016-11-29 10:58:54 +02:00 • committed by Gerrit - the friendly Code Review server
parent 04947ea3d8
commit a5edb54e93
1 changed files with 12 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
drivers/soc/qcom/spcom.c
View file

@ -1539,13 +1539,18 @@ static int spcom_handle_lock_ion_buf_command(struct spcom_channel *ch,
struct ion_handle *ion_handle;
int i;
if (size != sizeof(*cmd)) {
pr_err("cmd size [%d] , expected [%d].\n",
(int) size, (int) sizeof(*cmd));
return -EINVAL;
}
/* Check ION client */
if (spcom_dev->ion_client == NULL) {
pr_err("invalid ion client.\n");
return -ENODEV;
}
/* Get ION handle from fd - this increments the ref count */
ion_handle = ion_import_dma_buf(spcom_dev->ion_client, fd);
if (ion_handle == NULL) {
@ -1591,6 +1596,12 @@ static int spcom_handle_unlock_ion_buf_command(struct spcom_channel *ch,
struct ion_client *ion_client = spcom_dev->ion_client;
int i;
if (size != sizeof(*cmd)) {
pr_err("cmd size [%d] , expected [%d].\n",
(int) size, (int) sizeof(*cmd));
return -EINVAL;
}
/* Check ION client */
if (ion_client == NULL) {
pr_err("fail to create ion client.\n");