msm: ADSPRPC: Buffer length truncated while validation

The buffer length that is being used to validate gets truncated due to it being assigned to wrong type causing invalid memory to be accessed when the actual buffer length is used to copy user buffer contents. Bug: 31695439 CRs-Fixed: 1086123 Change-Id: If04dee27b8bae04eef7455773d9f4327fd008a21 Signed-off-by: Sathish Ambley <[email protected]> Signed-off-by: Biswajit Paul <[email protected]> Signed-off-by: Francisco Franco <[email protected]>
franciscofranco · Nov 7, 2017 · e407c45 · e407c45
1 parent 7fad3d7
commit e407c45
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
@@ -353,7 +353,8 @@ static int get_page_list(uint32_t kernel, uint32_t sc, remote_arg_t *pra,
 	pgstart->size = obuf->size;
 	for (i = 0; i < inbufs + outbufs; ++i) {
 		void *buf;
-		int len, num;
+		int num;
+		ssize_t len;
 
 		list[i].num = 0;
 		list[i].pgidx = 0;