From 78ef5ad5fb6d854348f17404dbff37e0edbfeb20 Mon Sep 17 00:00:00 2001 From: Nick Desaulniers Date: Wed, 17 Feb 2016 16:08:47 -0800 Subject: [PATCH] msm: thermal: validate userspace args to prevent buffer overflow. Prevent a userspace ioctl variable from accessing an array out of bounds. BUG: 27243728 Change-Id: I43690364273ace4a22e214bab88c76f0749c6d4f --- drivers/thermal/msm_thermal-dev.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/thermal/msm_thermal-dev.c b/drivers/thermal/msm_thermal-dev.c index 171764275066..db37ba77e55e 100644 --- a/drivers/thermal/msm_thermal-dev.c +++ b/drivers/thermal/msm_thermal-dev.c @@ -100,6 +100,16 @@ static long validate_and_copy(unsigned int *cmd, unsigned long *arg, goto validate_exit; } break; + case MSM_THERMAL_GET_CLUSTER_FREQUENCY_PLAN: + if (query->clock_freq.cluster_num >= NR_CPUS) { + ret = -EINVAL; + goto validate_exit; + } + case MSM_THERMAL_GET_CLUSTER_VOLTAGE_PLAN: + if (query->voltage.cluster_num >= NR_CPUS) { + ret = -EINVAL; + goto validate_exit; + } default: break; }