diff options
| author | tharun kumar <mtharu@codeaurora.org> | 2017-08-14 10:35:28 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-08-16 02:55:10 -0700 |
| commit | 73b20757e5640e348f7881d2e38ccddcb6ab0a86 (patch) | |
| tree | 98964bb9388ebaa2486d69dceb8dcb85a388c6e2 | |
| parent | a49bb61510b938152025049730fa922c5da950a1 (diff) | |
msm: ADSPRPC: validate user buffers after copying from user
validate user buffers before accessing in kernel driver.
Change-Id: I7997d069d0549de03f1467c63bdb81b20fcf3d6c
Acked-by: Chenna Kesava Raju <chennak@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
| -rw-r--r-- | drivers/char/adsprpc.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 774ac3538075..65b1bf920c83 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -2700,6 +2700,10 @@ static long fastrpc_device_ioctl(struct file *file, unsigned int ioctl_num, VERIFY(err, 0 == copy_from_user(&p.init, param, size)); if (err) goto bail; + VERIFY(err, p.init.init.filelen >= 0 && + p.init.init.memlen >= 0); + if (err) + goto bail; VERIFY(err, 0 == fastrpc_init_process(fl, &p.init)); if (err) goto bail; |