joy/android_kernel_sony_sdm845
Watch
1
Fork
You've already forked android_kernel_sony_sdm845
 0
Code Issues Pull requests Projects Releases Wiki Activity

BACKPORT: memshare: Prevent possible integer overflow

Browse source 
Prevent possible integer overflow by sanitizing the alloc request
size coming from the client against allottable amount of memory.

Change-Id: I74cb0f7b0808f20299586969fd5c810d44c3e576
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
Signed-off-by: Michael Bestas <mkbestas@lineageos.org>
This commit is contained in:
Manoj Prabhu B 2023-10-03 12:09:39 +05:30 • committed by Michael Bestas
commit 26dd511c91
No known key found for this signature in database
GPG key ID: CC95044519BE6669
1 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
drivers/soc/qcom/memshare/msm_memshare.c
View file

@ -564,8 +564,12 @@ static int handle_alloc_generic_req(void *req_h, void *req, void *conn_h)
return -EINVAL;
}
if (!memblock[client_id].allotted) {
if (alloc_req->client_id == 1 && alloc_req->num_bytes > 0)
if (!memblock[client_id].allotted && alloc_req->num_bytes > 0) {
if (alloc_req->num_bytes > memblock[client_id].size)
alloc_req->num_bytes = memblock[client_id].size;
if (alloc_req->client_id == 1)
size = alloc_req->num_bytes + MEMSHARE_GUARD_BYTES;
else
size = alloc_req->num_bytes;