arm: mach-msm: fix integer overflow in DFE ioctls for reg arr rw
Added error checks for upper limit of param.num in DFE ioctls
for register array r/w
Change-Id: I62d2eac38024c6c64f8d2d0f6d65f409569b2a76
Acked-by: John Nicholas <jnichola@qti.qualcomm.com>
Signed-off-by: Venkatesh Yadav Abbarapu <quicvenkat@codeaurora.org>
diff --git a/arch/arm/mach-msm/dfe-fsm9xxx.c b/arch/arm/mach-msm/dfe-fsm9xxx.c
index 9f9803d..3470710 100644
--- a/arch/arm/mach-msm/dfe-fsm9xxx.c
+++ b/arch/arm/mach-msm/dfe-fsm9xxx.c
@@ -222,8 +222,9 @@
return -EFAULT;
if (!HH_OFFSET_VALID(param.offset))
return -EINVAL;
- if (param.num == 0)
- break;
+ if ((param.num == 0) ||
+ (param.num >= (UINT32_MAX / sizeof(unsigned int))))
+ return -EINVAL;
req_sz = sizeof(unsigned int) * param.num;
if (pdfi->array_num < param.num) {