The cros_ec_cmd_xfer() function is used to communicate with the EC and callers set the sizes of data in the input and output buffers.
But these sizes need to be checked to ensure that don't exceed the fixed maximum length of the input and output buffers. Reported-by : Dan Carpenter <[email protected]> Signed-off-by: Javier Martinez Canillas <[email protected]> --- drivers/mfd/cros_ec.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c index c4aecc6f8373..07c53c27c82a 100644 --- a/drivers/mfd/cros_ec.c +++ b/drivers/mfd/cros_ec.c @@ -70,6 +70,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev, { int ret; + if (msg->insize > ARRAY_SIZE(msg->indata)) { + dev_err(ec_dev->dev, + "response of size %u is too big (max: %u)\n", + msg->insize, ARRAY_SIZE(msg->indata)); + return -EMSGSIZE; + } + + if (msg->outsize > ARRAY_SIZE(msg->outdata)) { + dev_err(ec_dev->dev, + "request of size %u is too big (max: %u)\n", + msg->outsize, ARRAY_SIZE(msg->outdata)); + return -EMSGSIZE; + } + mutex_lock(&ec_dev->lock); ret = ec_dev->cmd_xfer(ec_dev, msg); if (msg->result == EC_RES_IN_PROGRESS) { -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
