From 26dd511c9170ce14eef2f2fa5edf10fa258a359a Mon Sep 17 00:00:00 2001 From: Manoj Prabhu B Date: Tue, 3 Oct 2023 12:09:39 +0530 Subject: [PATCH] BACKPORT: memshare: Prevent possible integer overflow Prevent possible integer overflow by sanitizing the alloc request size coming from the client against allottable amount of memory. Change-Id: I74cb0f7b0808f20299586969fd5c810d44c3e576 Signed-off-by: Manoj Prabhu B Signed-off-by: Michael Bestas --- drivers/soc/qcom/memshare/msm_memshare.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/memshare/msm_memshare.c b/drivers/soc/qcom/memshare/msm_memshare.c index 6542861a2f48..1aa6c3457cb7 100644 --- a/drivers/soc/qcom/memshare/msm_memshare.c +++ b/drivers/soc/qcom/memshare/msm_memshare.c @@ -564,8 +564,12 @@ static int handle_alloc_generic_req(void *req_h, void *req, void *conn_h) return -EINVAL; } - if (!memblock[client_id].allotted) { - if (alloc_req->client_id == 1 && alloc_req->num_bytes > 0) + if (!memblock[client_id].allotted && alloc_req->num_bytes > 0) { + + if (alloc_req->num_bytes > memblock[client_id].size) + alloc_req->num_bytes = memblock[client_id].size; + + if (alloc_req->client_id == 1) size = alloc_req->num_bytes + MEMSHARE_GUARD_BYTES; else size = alloc_req->num_bytes;