diff options
| author |   Jann Horn <jannh@google.com> | 2025-04-28 15:06:43 +0200 |
|---|---|---|
| committer |   Jens Wiklander <jens.wiklander@linaro.org> | 2025-04-30 14:57:03 +0200 |
| commit | 39bb67edcc582b3b386a9ec983da67fa8a10ec03 (patch) | |
| tree | 39adeb70868ae40467e5266129da951cfd51541b /scripts/lib/kdoc/kdoc_files.py | |
| parent | tee: optee: smc: remove unnecessary NULL check before release_firmware() (diff) | |
| download | linux-rng-39bb67edcc582b3b386a9ec983da67fa8a10ec03.tar.xz linux-rng-39bb67edcc582b3b386a9ec983da67fa8a10ec03.zip | |
tee: Prevent size calculation wraparound on 32-bit kernels
The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on
32-bit kernels: Multiplying a user-provided 32-bit value with the
size of a structure can wrap around on such platforms.
Fix it by using saturating arithmetic for the size calculation.
This has no security consequences because, in all users of
TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks
for wrapping.
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>
Diffstat (limited to 'scripts/lib/kdoc/kdoc_files.py')
0 files changed, 0 insertions, 0 deletions