diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index f18d59dc0732..99d05144d1fc 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -2230,7 +2230,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) int outbufs = REMOTE_SCALARS_OUTBUFS(sc); int handles, bufs = inbufs + outbufs; uintptr_t args = 0; - size_t rlen = 0, copylen = 0, metalen = 0, lrpralen = 0; + size_t rlen = 0, copylen = 0, metalen = 0, lrpralen = 0, templen = 0; size_t totallen = 0; //header and non ion copy buf len int i, oix; int err = 0, j = 0; @@ -2328,12 +2328,13 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) copylen = ALIGN(copylen, BALIGN); mstart = ctx->overps[oix]->mstart; mend = ctx->overps[oix]->mend; - VERIFY(err, (mend - mstart) <= LONG_MAX); + templen = mend - mstart; + VERIFY(err, ((templen <= LONG_MAX) && (copylen <= (LONG_MAX - templen)))); if (err) { err = -EFAULT; goto bail; } - copylen += mend - mstart; + copylen += templen; } totallen = ALIGN(totallen, BALIGN) + copylen;