From 55510843c1630f6067aae4c45ff2929a51f56b4d Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 19 Nov 2015 18:28:01 +0100 Subject: [PATCH] greybus: svc: fix missing version-request sanity checks Add missing sanity checks on version-request payload size. Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/staging/greybus/svc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/staging/greybus/svc.c b/drivers/staging/greybus/svc.c index 6c1a157c10c5..bd045678493f 100644 --- a/drivers/staging/greybus/svc.c +++ b/drivers/staging/greybus/svc.c @@ -310,6 +310,14 @@ static int gb_svc_version_request(struct gb_operation *op) struct gb_protocol_version_request *request; struct gb_protocol_version_response *response; + if (op->request->payload_size < sizeof(*request)) { + pr_err("%d: short version request (%zu < %zu)\n", + connection->intf_cport_id, + op->request->payload_size, + sizeof(*request)); + return -EINVAL; + } + request = op->request->payload; if (request->major > GB_SVC_VERSION_MAJOR) { -- 2.20.1