commit 574b4017c5719a539f9e08286480f8e3b59fe178
author Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org> Mon Nov 11 18:02:27 2013 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Feb 18 22:37:40 2014 -0800
tree 19d2766ea987aec9b5b0273a6e3aea71c4e9a2d8
parent fb999d59687a0e50957ead97a25c31fdc1d15eea

arm: mach-msm: fix integer overflow in DFE_IOCTL_COMMAND

Added error checks for upper limit of param.num in
DFE_IOCTL_COMMAND

Change-Id: I0143813d38ec7a5dfa7a8307b075daf7d4a4d101
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>

arch/arm/mach-msm/dfe-fsm9xxx.c

diff --git a/arch/arm/mach-msm/dfe-fsm9xxx.c b/arch/arm/mach-msm/dfe-fsm9xxx.c
index 66272d2..9f9803d 100644
--- a/arch/arm/mach-msm/dfe-fsm9xxx.c
+++ b/arch/arm/mach-msm/dfe-fsm9xxx.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2013, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -50,6 +50,8 @@
 					HH_IRQ_FIFO_SIZE) == \
 					(pdev)->irq_fifo_head)
 
+#define UINT32_MAX  (0xFFFFFFFFU)
+
 static struct hh_dev_node_info {
 	spinlock_t hh_lock;
 	char irq_fifo[HH_IRQ_FIFO_SIZE];
@@ -270,8 +272,10 @@
 
 			if (copy_from_user(&param, argp, sizeof param))
 				return -EFAULT;
-			if (param.num == 0)
-				break;
+			if ((param.num == 0) ||
+			(param.num >= (UINT32_MAX  /
+			sizeof(struct dfe_command_entry))))
+				return -EINVAL;
 			req_sz = sizeof(struct dfe_command_entry) * param.num;
 
 			if (pdfi->cmd_num < param.num) {