A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

haven: hh_rm_iface: Avoid integer overflow for req_payload_size calculation

Browse source 
There is a possibility for the calculation to overflow when size is large
enough to overflow when added to the size of payload. Ensure that this
overflow is caught early.

Change-Id: I876fbaa704ba51dc4a9e4eb4d3f7f0eaa749e06d
Signed-off-by: Prakruthi Deepak Heragu <pheragu@codeaurora.org>
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>
This commit is contained in:
Prakruthi Deepak Heragu 2021-08-24 19:34:43 -07:00 • committed by Gerrit - the friendly Code Review server
commit b59a9f3479
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/virt/haven/hh_rm_iface.c
View file

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
*
*/
@ -121,6 +121,8 @@ hh_rm_vm_get_hyp_res(hh_vmid_t vmid, u32 *n_entries)
/* The response payload should contain all the resource entries */
if (resp_payload_size < sizeof(*n_entries) ||
(sizeof(*n_entries) > (U32_MAX -
(resp_payload->n_resource_entries * sizeof(*resp_entries)))) ||
resp_payload_size != sizeof(*n_entries) +
(resp_payload->n_resource_entries * sizeof(*resp_entries))) {
pr_err("%s: Invalid size received for GET_HYP_RESOURCES: %u\n",
@ -614,7 +616,7 @@ int hh_rm_console_write(hh_vmid_t vmid, const char *buf, size_t size)
int reply_err_code = 0;
size_t req_payload_size = sizeof(*req_payload) + size;
if (size < 1 || size > U32_MAX)
if (size < 1 || size > (U32_MAX - sizeof(*req_payload)))
return -EINVAL;
req_payload = kzalloc(req_payload_size, GFP_KERNEL);