A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

mem_buf: Validate n_acl_entries

Browse source 
Validate n_acl_entries specified by the requesting VM.

Limiting n_acl_entries to 1 for now based on the existing check in
mem_buf_alloc().

Change-Id: I802219ada9ee9109d18a42b2a80539d1cbd4df64
Signed-off-by: Vijayanand Jitta <quic_vjitta@quicinc.com>
This commit is contained in:
Vijayanand Jitta 2022-05-10 10:16:42 +05:30 • committed by Gerrit - the friendly Code Review server
commit 3a4f3d2090
1 changed files with 11 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

15
drivers/soc/qcom/mem-buf.c
View file

@ -529,12 +529,19 @@ struct mem_buf_xfer_mem *mem_buf_prep_xfer_mem(void *req_msg)
int ret;
struct mem_buf_xfer_mem *xfer_mem;
struct mem_buf_alloc_req *req = req_msg;
u32 nr_acl_entries = req->acl_desc.n_acl_entries;
size_t alloc_req_msg_size = offsetof(struct mem_buf_alloc_req,
acl_desc.acl_entries[nr_acl_entries]);
void *arb_payload = req_msg + alloc_req_msg_size;
u32 nr_acl_entries;
size_t alloc_req_msg_size;
void *arb_payload;
void *mem_type_data;
nr_acl_entries = req->acl_desc.n_acl_entries;
if (nr_acl_entries != 1)
return ERR_PTR(-EINVAL);
alloc_req_msg_size = offsetof(struct mem_buf_alloc_req,
acl_desc.acl_entries[nr_acl_entries]);
arb_payload = req_msg + alloc_req_msg_size;
xfer_mem = kzalloc(sizeof(*xfer_mem), GFP_KERNEL);
if (!xfer_mem)
return ERR_PTR(-ENOMEM);