From: K. Y. Srinivasan <kys@microsoft.com>
Date: Fri, 28 Oct 2011 22:11:27 +0000 (-0700)
Subject: Staging: hv: mousevsc: Add a check to prevent memory corruption
X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=226383751ff3ce67a648653e8bfe0842f36bbf96;p=deliverable%2Flinux.git

Staging: hv: mousevsc: Add a check to prevent memory corruption

Add a check to prevent memory corruption.

Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/staging/hv/hv_mouse.c b/drivers/staging/hv/hv_mouse.c
index 7c7449bb5cf1..c22f729155fc 100644
--- a/drivers/staging/hv/hv_mouse.c
+++ b/drivers/staging/hv/hv_mouse.c
@@ -274,6 +274,18 @@ static void mousevsc_on_receive(struct hv_device *device,
 
 	switch (hid_msg->header.type) {
 	case SYNTH_HID_PROTOCOL_RESPONSE:
+		/*
+		 * While it will be impossible for us to protect against
+		 * malicious/buggy hypervisor/host, add a check here to
+		 * ensure we don't corrupt memory.
+		 */
+		if ((pipe_msg->size + sizeof(struct pipe_prt_msg)
+			- sizeof(unsigned char))
+			> sizeof(struct mousevsc_prt_msg)) {
+			WARN_ON(1);
+			break;
+		}
+
 		memcpy(&input_dev->protocol_resp, pipe_msg,
 		       pipe_msg->size + sizeof(struct pipe_prt_msg) -
 		       sizeof(unsigned char));