msm: smd_pkt: catch possible array out of bounds accesses
Check to see that the device timeout that is being accessed is a valid
device instead of always assuming we get a valid device, and thus prevent
an array out of bounds access.
Change-Id: I9690bede1820b9920594e3533c14b8a5c20b337f
Signed-off-by: Jeffrey Hugo <jhugo@codeaurora.org>
diff --git a/arch/arm/mach-msm/smd_pkt.c b/arch/arm/mach-msm/smd_pkt.c
index 4744f1f..8023129 100644
--- a/arch/arm/mach-msm/smd_pkt.c
+++ b/arch/arm/mach-msm/smd_pkt.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2008-2011, Code Aurora Forum. All rights reserved.
+/* Copyright (c) 2008-2012, Code Aurora Forum. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -114,6 +114,11 @@
if (smd_pkt_devp[i]->devicep == d)
break;
}
+ if (i >= NUM_SMD_PKT_PORTS) {
+ pr_err("%s: unable to match device to valid smd_pkt port\n",
+ __func__);
+ return -EINVAL;
+ }
if (!strict_strtoul(buf, 10, &tmp)) {
smd_pkt_devp[i]->open_modem_wait = tmp;
return n;
@@ -133,6 +138,11 @@
if (smd_pkt_devp[i]->devicep == d)
break;
}
+ if (i >= NUM_SMD_PKT_PORTS) {
+ pr_err("%s: unable to match device to valid smd_pkt port\n",
+ __func__);
+ return -EINVAL;
+ }
return snprintf(buf, PAGE_SIZE, "%d\n",
smd_pkt_devp[i]->open_modem_wait);
}