diff options
| -rw-r--r-- | drivers/cxl/core/features.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/cxl/core/features.c b/drivers/cxl/core/features.c index 8731b95dd0b5..d50e6b58d8fd 100644 --- a/drivers/cxl/core/features.c +++ b/drivers/cxl/core/features.c @@ -474,6 +474,10 @@ static void *cxlctl_get_feature(struct cxl_features_state *cxlfs, if (!count) return ERR_PTR(-EINVAL); + if (out_size < offsetof(struct fwctl_rpc_cxl_out, payload) || + count > out_size - offsetof(struct fwctl_rpc_cxl_out, payload)) + return ERR_PTR(-EINVAL); + struct fwctl_rpc_cxl_out *rpc_out __free(kvfree) = kvzalloc(out_size, GFP_KERNEL); if (!rpc_out) |