From: Johan Hovold <johan@hovoldconsulting.com>
Date: Thu, 19 Nov 2015 17:28:01 +0000 (+0100)
Subject: greybus: svc: fix missing version-request sanity checks
X-Git-Tag: v4.9-rc1~119^2~378^2~21^2~1030
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=55510843c1630f6067aae4c45ff2929a51f56b4d;p=karo-tx-linux.git

greybus: svc: fix missing version-request sanity checks

Add missing sanity checks on version-request payload size.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
---

diff --git a/drivers/staging/greybus/svc.c b/drivers/staging/greybus/svc.c
index 6c1a157c10c5..bd045678493f 100644
--- a/drivers/staging/greybus/svc.c
+++ b/drivers/staging/greybus/svc.c
@@ -310,6 +310,14 @@ static int gb_svc_version_request(struct gb_operation *op)
 	struct gb_protocol_version_request *request;
 	struct gb_protocol_version_response *response;
 
+	if (op->request->payload_size < sizeof(*request)) {
+		pr_err("%d: short version request (%zu < %zu)\n",
+				connection->intf_cport_id,
+				op->request->payload_size,
+				sizeof(*request));
+		return -EINVAL;
+	}
+
 	request = op->request->payload;
 
 	if (request->major > GB_SVC_VERSION_MAJOR) {