From patchwork Thu Mar 12 17:02:42 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Martinez Canillas X-Patchwork-Id: 5997441 Return-Path: X-Original-To: patchwork-linux-samsung-soc@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E7861BF90F for ; Thu, 12 Mar 2015 17:05:33 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id EC2D02034F for ; Thu, 12 Mar 2015 17:05:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0994220379 for ; Thu, 12 Mar 2015 17:05:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754846AbbCLRDZ (ORCPT ); Thu, 12 Mar 2015 13:03:25 -0400 Received: from bhuna.collabora.co.uk ([93.93.135.160]:46847 "EHLO bhuna.collabora.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754805AbbCLRDY (ORCPT ); Thu, 12 Mar 2015 13:03:24 -0400 Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: javier) with ESMTPSA id 38087600D8A From: Javier Martinez Canillas To: Olof Johansson Cc: Lee Jones , Doug Anderson , Bill Richardson , Simon Glass , Gwendal Grignou , Stephen Barber , Todd Broch , linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org, Javier Martinez Canillas Subject: [PATCH 2/8] mfd: cros_ec: Sanity check in and out sizes Date: Thu, 12 Mar 2015 18:02:42 +0100 Message-Id: <1426179768-27482-3-git-send-email-javier.martinez@collabora.co.uk> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1426179768-27482-1-git-send-email-javier.martinez@collabora.co.uk> References: <1426179768-27482-1-git-send-email-javier.martinez@collabora.co.uk> Sender: linux-samsung-soc-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-samsung-soc@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The cros_ec_cmd_xfer() function is used to communicate with the EC and callers set the sizes of data in the input and output buffers. But these sizes need to be checked to ensure that don't exceed the fixed maximum length of the input and output buffers. Reported-by : Dan Carpenter Signed-off-by: Javier Martinez Canillas --- drivers/mfd/cros_ec.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c index c4aecc6f8373..07c53c27c82a 100644 --- a/drivers/mfd/cros_ec.c +++ b/drivers/mfd/cros_ec.c @@ -70,6 +70,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev, { int ret; + if (msg->insize > ARRAY_SIZE(msg->indata)) { + dev_err(ec_dev->dev, + "response of size %u is too big (max: %u)\n", + msg->insize, ARRAY_SIZE(msg->indata)); + return -EMSGSIZE; + } + + if (msg->outsize > ARRAY_SIZE(msg->outdata)) { + dev_err(ec_dev->dev, + "request of size %u is too big (max: %u)\n", + msg->outsize, ARRAY_SIZE(msg->outdata)); + return -EMSGSIZE; + } + mutex_lock(&ec_dev->lock); ret = ec_dev->cmd_xfer(ec_dev, msg); if (msg->result == EC_RES_IN_PROGRESS) {