diff options
| author | PixelBot AutoMerger <android-nexus-securitybot@system.gserviceaccount.com> | 2021-12-19 18:37:36 -0800 |
|---|---|---|
| committer | SecurityBot <android-nexus-securitybot@system.gserviceaccount.com> | 2021-12-19 18:37:36 -0800 |
| commit | 2a57b06c215740c225180d3331ca765419ccdda4 (patch) | |
| tree | 5a09043b6286f6ccf2fbf57e889c3926aef67bb0 | |
| parent | 5c748cbce9e0db01814b11370210ba036f519a9e (diff) | |
| parent | 4018dcf68c497e7d3cc9dbaea7c92103ccca87b3 (diff) | |
| download | lwis-2a57b06c215740c225180d3331ca765419ccdda4.tar.gz | |
Merge android12-gs-pixel-5.10-sc-qpr2 into android12-gs-pixel-5.10-sc-v2
SBMerger: 410055097
Change-Id: Ie25209ffbeef2e3ea60ec0d24fd4e685bb733e2a
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>
| -rw-r--r-- | lwis_ioctl.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lwis_ioctl.c b/lwis_ioctl.c index f058643..7453d8b 100644 --- a/lwis_ioctl.c +++ b/lwis_ioctl.c @@ -293,10 +293,14 @@ static int copy_io_entries(struct lwis_device *lwis_dev, struct lwis_io_entries /* Copy io_entries from userspace */ if (copy_from_user(k_msg, (void __user *)user_msg, sizeof(*k_msg))) { - dev_err(lwis_dev->dev, "Failed to copy io_entries header from userspace."); + dev_err(lwis_dev->dev, "Failed to copy io_entries header from userspace.\n"); return -EFAULT; } buf_size = sizeof(struct lwis_io_entry) * k_msg->num_io_entries; + if (buf_size / sizeof(struct lwis_io_entry) != k_msg->num_io_entries) { + dev_err(lwis_dev->dev, "Failed to copy io_entries due to integer overflow.\n"); + return -EINVAL; + } io_entries = kvmalloc(buf_size, GFP_KERNEL); if (!io_entries) { dev_err(lwis_dev->dev, "Failed to allocate io_entries buffer\n"); @@ -305,7 +309,7 @@ static int copy_io_entries(struct lwis_device *lwis_dev, struct lwis_io_entries if (copy_from_user(io_entries, (void __user *)k_msg->io_entries, buf_size)) { ret = -EFAULT; kvfree(io_entries); - dev_err(lwis_dev->dev, "Failed to copy io_entries from userspace."); + dev_err(lwis_dev->dev, "Failed to copy io_entries from userspace.\n"); return ret; } *k_entries = io_entries; |