Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

[Bluetooth] - Fix for checking proper user-supplied buffers 

During patch download of devices, size validations & zero alloc
the buffers to ensure values passed are in range

CRs-fixed: 2084692
Change-Id: Ie1cd76fe68766d6d12d7262202e48c18ebe42274
Signed-off-by: Balvinder Singh <bpsingh@codeaurora.org>
Signed-off-by: Yasir Malik <ymalik@codeaurora.org>
This commit is contained in:
Balvinder Singh 2017-11-06 11:50:46 +05:30 committed by Gerrit - the friendly Code Review server
parent f83822aa48
commit 08c52f8474
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/bluetooth/ath3k.c
View File

@ -213,13 +213,27 @@ static int ath3k_load_firmware(struct usb_device *udev,
{
u8 *send_buf;
int err, pipe, len, size, sent = 0;
int count = firmware->size;
int count;
BT_DBG("udev %p", udev);
if (!firmware || !firmware->data || firmware->size <= 0) {
err = -EINVAL;
BT_ERR("Not a valid FW file");
return err;
}
count = firmware->size;
if (count < FW_HDR_SIZE) {
err = -EINVAL;
BT_ERR("ath3k loading invalid size of file");
return err;
}
pipe = usb_sndctrlpipe(udev, 0);
send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);
send_buf = kzalloc(BULK_SIZE, GFP_KERNEL);
if (!send_buf) {
BT_ERR("Can't allocate memory chunk for firmware");
return -ENOMEM;