android/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "gunyah: virtio: Check for valid config_size in ioctl"

Browse Source
This commit is contained in:
qctecmdr 2022-06-24 03:50:50 -07:00 committed by Gerrit - the friendly Code Review server
commit 0f4962f526
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/virt/gunyah/gh_virtio_backend.c
View File

@ -630,14 +630,18 @@ static long virtio_backend_ioctl(struct file *file, unsigned int cmd,
if (copy_from_user(&d, argp, sizeof(d))) if (copy_from_user(&d, argp, sizeof(d)))
return -EFAULT; return -EFAULT;
if (!d.label || !d.config_size || !d.config_data)
return -EINVAL;
vb_dev = vb_dev_get(vm, d.label); vb_dev = vb_dev_get(vm, d.label);
if (!vb_dev) if (!vb_dev)
return -EINVAL; return -EINVAL;
mutex_lock(&vb_dev->mutex); mutex_lock(&vb_dev->mutex);
if (!d.label || d.config_size > vb_dev->config_shared_size ||
!d.config_size || !d.config_data) {
mutex_unlock(&vb_dev->mutex);
vb_dev_put(vb_dev);
return -EINVAL;
}
if (!vb_dev->config_shared_buf) { if (!vb_dev->config_shared_buf) {
mutex_unlock(&vb_dev->mutex); mutex_unlock(&vb_dev->mutex);
vb_dev_put(vb_dev); vb_dev_put(vb_dev);