author: Dan Carpenter <dan.carpenter@oracle.com> 2019-05-14 15:47:03 -0700
committer: Linus Torvalds <torvalds@linux-foundation.org> 2019-05-14 19:52:52 -0700
commit: 6a024330650e24556b8a18cc654ad00cfecf6c6c
parent: c8ea3663f7a8e6996d44500ee818c9330ac4fd88
Commit Summary:
Diffstat:
1 file changed, 3 insertions, 0 deletions
diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
index a41431edbf25..93d5bebf9572 100644
--- a/drivers/virt/fsl_hypervisor.c
+++ b/drivers/virt/fsl_hypervisor.c
@@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
* hypervisor.
*/
lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
+ if (param.count == 0 ||
+ param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
+ return -EINVAL;
num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
/* Allocate the buffers we need */