tree 5dc83e00a367e9fce330e2fe2ec47b4011c792b1
parent f2803b2d0d111c35aebfb435b90b97d35250c07d
author Luigi Santivetti <luigi.santivetti@imagination.corp-partner.google.com> 1614296588 +0000
committer Commit Bot <commit-bot@chromium.org> 1615853937 +0000

CHROMIUM: img-rogue: check invalid annotation size in PMRs

This change adds a check for annotation pointer and size
passed from the client driver to PhysmemNewRamBackedPMR()
function. We are expecting for the annotation to be always
passed from the user space.

It also added a missing check if both ui32NumPhysChunks and
ui32NumVirtChunks are 0. If both those values are 0 the
function call doesn't make sense as it would mean that we're
trying to allocate memory of size 0.

BUG=b:180769981
TEST=Run syzkaller

Change-Id: Ie71d4b36e61fe1b29d8114b8621fa773518b35e3
Signed-off-by: Luigi Santivetti <luigi.santivetti@imagination.corp-partner.google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/2720329
Reviewed-by: Hsin-Yi Wang <hsinyi@chromium.org>
Commit-Queue: Hsin-Yi Wang <hsinyi@chromium.org>