As the length datatype is signed, an attacker can both overflow
the calculation or supply a negative number to trick the check
into returning an chosen chunk. This can have undesired
consequences. Always use unsigned integer types for length
values.
Change-Id: Ifde2f0d35129014b976507f7723a319c53fabddf
Acked-by: Thyagarajan Venkatanarayanan <venkatan@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
Bug: 63165135
CRs-Fixed: 2139538
Signed-off-by: Dennis Cagle <dcagle@codeaurora.org>
(cherry picked from commit c29e11c774b3c59660c1c599b73b7fabf1492d43)
Signed-off-by: David Lin <dtwlin@google.com>
The buffers being passed in the invocation are copied from user
memory into the context using copy_from_user. Lookup the buffer
pointers from the context where it was copied rather than directly
accessing it from the user memory.
Bug: 29156684
Change-Id: Ief5a840f17f6287ebd48b4ae52facaccb271fab8
Signed-off-by: Sathish Ambley <sathishambley@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
The new ioctl exposes mechanism for user processes to create
a new process on the remote end when the device is opened.
Change-Id: Id27c7572d3bdd5ecfb899ac20dd237ab25f5a161
Acked-by: Sathish Ambley <sambley@qti.qualcomm.com>
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Update the data types to handle 64 bit address space and
communicate 64 bit addresses to remote processor. Provide
compat ioctl call to allow for 32 bit user space to call
into the driver.
Change-Id: I954f07382bbc9998aed574a7bf74fab9299f0b45
Acked-by: Sathish Ambley <sambley@qti.qualcomm.com>
Signed-off-by: Mitchel Humpherys <mitchelh@codeaurora.org>
Dennis Cagle