redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

greybus: uart: add max-payload sanity check 

Let's be well behaved and add a sanity check on the maximum greybus
payload size to avoid underflow on the calculated buffer size.

Reviewed-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
hifive-unleashed-5.1
Johan Hovold 2016-02-24 16:11:49 +01:00 committed by Greg Kroah-Hartman
parent 71f6c3231c
commit 066f950c65
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/staging/greybus/uart.c
View File

@ -587,6 +587,7 @@ static void gb_tty_exit(void);
static int gb_uart_connection_init(struct gb_connection *connection)
{
size_t max_payload;
struct gb_tty *gb_tty;
struct device *tty_dev;
int retval;
@ -607,8 +608,13 @@ static int gb_uart_connection_init(struct gb_connection *connection)
goto error_alloc;
}
gb_tty->buffer_payload_max =
gb_operation_get_payload_size_max(connection) -
max_payload = gb_operation_get_payload_size_max(connection);
if (max_payload < sizeof(struct gb_uart_send_data_request)) {
retval = -EINVAL;
goto error_payload;
}
gb_tty->buffer_payload_max = max_payload -
sizeof(struct gb_uart_send_data_request);
gb_tty->buffer = kzalloc(gb_tty->buffer_payload_max, GFP_KERNEL);