From 470ff23716148828a0e530103b9cf19212525bfa Mon Sep 17 00:00:00 2001 From: Zhen Kong Date: Tue, 27 Aug 2019 14:02:35 -0700 Subject: [PATCH] qseecom: check invalid handle for app loaded query request Check if the handle data type received from userspace is valid for app loaded query request to avoid the offset boundary check for qseecom_send_modfd_resp is bypassed. Bug: 143972932 Change-Id: I5f3611a8f830d6904213781c5ba70cfc0ba3e2e0 Signed-off-by: Zhen Kong CVE-2019-14041 Signed-off-by: Kevin F. Haggerty --- drivers/misc/qseecom.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 8402cfaa1b1..01da79e3b36 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -4188,6 +4188,13 @@ static long qseecom_ioctl(struct file *file, unsigned cmd, break; } case QSEECOM_IOCTL_APP_LOADED_QUERY_REQ: { + if ((data->type != QSEECOM_GENERIC) && + (data->type != QSEECOM_CLIENT_APP)) { + pr_err("app loaded query req: invalid handle (%d)\n", + data->type); + ret = -EINVAL; + break; + } data->type = QSEECOM_CLIENT_APP; pr_debug("APP_LOAD_QUERY: qseecom_addr = 0x%x\n", (u32)data); mutex_lock(&app_access_lock);