diff options
| author | Deepak Nibade <dnibade@nvidia.com> | 2016-03-11 13:59:20 +0530 |
|---|---|---|
| committer | Matthew Pedro <mapedro@nvidia.com> | 2016-05-23 10:24:19 -0700 |
| commit | bb7faf0544ccc7c310c27dd43857dc2a62fc7e5c (patch) | |
| tree | 622e0f1f8640a521b2b53c2fb858745ae557ba88 /drivers | |
| parent | 04ac7e0011f9845b69c4be3bedf058a350ca814c (diff) | |
video: tegra: host: check if offset is u32 aligned
In nvhost_ioctl_ctrl_module_regrdwr(), we copy offset
to read/write from user space but we do not have
any check on it
So it is possible for user space to add unaligned
offset and request read/write which would crash the
system
Fix this by explicitly checking alignment of the
offset passed by user space
Bug 1739935
Change-Id: Iea2a07c60500af876b732a0e9d9d08535aa53b5c
Signed-off-by: Deepak Nibade <dnibade@nvidia.com>
Reviewed-on: http://git-master/r/1029405
(cherry picked from commit 422baa09a17a6a17f4e572aa5441ca174634de0d)
Reviewed-on: http://git-master/r/1123363
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/video/tegra/host/bus_client.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/video/tegra/host/bus_client.c b/drivers/video/tegra/host/bus_client.c index 973b8f3c66ff..3eaa07bd7413 100644 --- a/drivers/video/tegra/host/bus_client.c +++ b/drivers/video/tegra/host/bus_client.c @@ -62,6 +62,10 @@ static int validate_reg(struct platform_device *ndev, u32 offset, int count) struct resource *r; struct nvhost_device_data *pdata = platform_get_drvdata(ndev); + /* check if offset is u32 aligned */ + if (offset & 3) + return -EINVAL; + r = platform_get_resource(pdata->master ? pdata->master : ndev, IORESOURCE_MEM, 0); if (!r) { |