arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND
Added error checks for upper limit of param.num in
DFE_IOCTL_COMMAND
Change-Id: I0143813d38ec7a5dfa7a8307b075daf7d4a4d101
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
diff --git a/arch/arm/mach-msm/dfe-fsm9xxx.c b/arch/arm/mach-msm/dfe-fsm9xxx.c
index 66272d2..9f9803d 100644
--- a/arch/arm/mach-msm/dfe-fsm9xxx.c
+++ b/arch/arm/mach-msm/dfe-fsm9xxx.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2013, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -50,6 +50,8 @@
HH_IRQ_FIFO_SIZE) == \
(pdev)->irq_fifo_head)
+#define UINT32_MAX (0xFFFFFFFFU)
+
static struct hh_dev_node_info {
spinlock_t hh_lock;
char irq_fifo[HH_IRQ_FIFO_SIZE];
@@ -270,8 +272,10 @@
if (copy_from_user(¶m, argp, sizeof param))
return -EFAULT;
- if (param.num == 0)
- break;
+ if ((param.num == 0) ||
+ (param.num >= (UINT32_MAX /
+ sizeof(struct dfe_command_entry))))
+ return -EINVAL;
req_sz = sizeof(struct dfe_command_entry) * param.num;
if (pdfi->cmd_num < param.num) {