[PATCH 2/8] mfd: cros_ec: Sanity check in and out sizes

[Javier Martinez Canillas]

The cros_ec_cmd_xfer() function is used to communicate with the EC
and callers set the sizes of data in the input and output buffers.

But these sizes need to be checked to ensure that don't exceed the
fixed maximum length of the input and output buffers.

Reported-by : Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Javier Martinez Canillas <javier.martinez@xxxxxxxxxxxxxxx>
---
 drivers/mfd/cros_ec.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c
index c4aecc6f8373..07c53c27c82a 100644
--- a/drivers/mfd/cros_ec.c
+++ b/drivers/mfd/cros_ec.c
@@ -70,6 +70,20 @@ int cros_ec_cmd_xfer(struct cros_ec_device *ec_dev,
 {
 	int ret;
 
+	if (msg->insize > ARRAY_SIZE(msg->indata)) {
+		dev_err(ec_dev->dev,
+			"response of size %u is too big (max: %u)\n",
+			msg->insize, ARRAY_SIZE(msg->indata));
+		return -EMSGSIZE;
+	}
+
+	if (msg->outsize > ARRAY_SIZE(msg->outdata)) {
+		dev_err(ec_dev->dev,
+			"request of size %u is too big (max: %u)\n",
+			msg->outsize, ARRAY_SIZE(msg->outdata));
+		return -EMSGSIZE;
+	}
+
 	mutex_lock(&ec_dev->lock);
 	ret = ec_dev->cmd_xfer(ec_dev, msg);
 	if (msg->result == EC_RES_IN_PROGRESS) {
-- 
2.1.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/