From 3a4f3d209045c01d7c1220991afb686ffa53f91a Mon Sep 17 00:00:00 2001 From: Vijayanand Jitta Date: Tue, 10 May 2022 10:16:42 +0530 Subject: [PATCH] mem_buf: Validate n_acl_entries Validate n_acl_entries specified by the requesting VM. Limiting n_acl_entries to 1 for now based on the existing check in mem_buf_alloc(). Change-Id: I802219ada9ee9109d18a42b2a80539d1cbd4df64 Signed-off-by: Vijayanand Jitta --- drivers/soc/qcom/mem-buf.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/soc/qcom/mem-buf.c b/drivers/soc/qcom/mem-buf.c index 92bf52b7e7ce..5857e965f590 100644 --- a/drivers/soc/qcom/mem-buf.c +++ b/drivers/soc/qcom/mem-buf.c @@ -529,12 +529,19 @@ struct mem_buf_xfer_mem *mem_buf_prep_xfer_mem(void *req_msg) int ret; struct mem_buf_xfer_mem *xfer_mem; struct mem_buf_alloc_req *req = req_msg; - u32 nr_acl_entries = req->acl_desc.n_acl_entries; - size_t alloc_req_msg_size = offsetof(struct mem_buf_alloc_req, - acl_desc.acl_entries[nr_acl_entries]); - void *arb_payload = req_msg + alloc_req_msg_size; + u32 nr_acl_entries; + size_t alloc_req_msg_size; + void *arb_payload; void *mem_type_data; + nr_acl_entries = req->acl_desc.n_acl_entries; + if (nr_acl_entries != 1) + return ERR_PTR(-EINVAL); + + alloc_req_msg_size = offsetof(struct mem_buf_alloc_req, + acl_desc.acl_entries[nr_acl_entries]); + arb_payload = req_msg + alloc_req_msg_size; + xfer_mem = kzalloc(sizeof(*xfer_mem), GFP_KERNEL); if (!xfer_mem) return ERR_PTR(-ENOMEM);