diff options
| author | c_mtharu <mtharu@codeaurora.org> | 2017-11-27 20:13:28 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-12-04 02:34:54 -0800 |
| commit | b3c277dac5b3c9df50b4a092f369c3e6f14af262 (patch) | |
| tree | f39b5d3d1706d2773653b4d86272f44ed1f6b248 /drivers/char/adsprpc.c | |
| parent | 501a8de7b638d28c32338a124908258509b55371 (diff) | |
msm: ADSPRPC: use access_ok to validate pointers
Check the validity of the pointer in user space that you intend to
access. access_ok function simply checks that the address is likely
in user space, not in the kernel.
Change-Id: I936f73a2c2029f9e7ca12cc8fc06d0698e6710c0
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
Diffstat (limited to 'drivers/char/adsprpc.c')
| -rw-r--r-- | drivers/char/adsprpc.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 10753f2765f5..43bcd61c70ae 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1654,12 +1654,19 @@ static int fastrpc_init_process(struct fastrpc_file *fl, inbuf.namelen = strlen(current->comm) + 1; inbuf.filelen = init->filelen; fl->pd = 1; + + if (!access_ok(0, (void const __user *)init->file, + init->filelen)) + goto bail; if (init->filelen) { VERIFY(err, !fastrpc_mmap_create(fl, init->filefd, 0, init->file, init->filelen, mflags, &file)); if (err) goto bail; } + if (!access_ok(1, (void const __user *)init->mem, + init->memlen)) + goto bail; inbuf.pageslen = 1; VERIFY(err, !fastrpc_mmap_create(fl, init->memfd, 0, init->mem, init->memlen, mflags, &mem)); |