VMCI: Check userland-provided datagram size

[firefly-linux-kernel-4.4.55.git] / drivers / misc / vmw_vmci / vmci_host.c

diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index 66fc9921fc85d22b927ea2b297fde5ca199866ee..a721b5d8a9dacdafe85257c64ea7c1f545e6f743 100644 (file)
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -395,6 +395,12 @@ static int vmci_host_do_send_datagram(struct vmci_host_dev *vmci_host_dev,
                return -EFAULT;
        }
 
+       if (VMCI_DG_SIZE(dg) != send_info.len) {
+               vmci_ioctl_err("datagram size mismatch\n");
+               kfree(dg);
+               return -EINVAL;
+       }
+
        pr_devel("Datagram dst (handle=0x%x:0x%x) src (handle=0x%x:0x%x), payload (size=%llu bytes)\n",
                 dg->dst.context, dg->dst.resource,
                 dg->src.context, dg->src.resource,