{"push_id":658501418,"size":1,"distinct_size":1,"ref":"refs/heads/lollipop","head":"d5357878aeda050b80cd7befe50244ad3c5cf81a","before":"cc67742718dba3ef51d2df3fb91f248c5ccf1dbe","commits":[{"sha":"d5357878aeda050b80cd7befe50244ad3c5cf81a","author":{"email":"9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk","name":"Ian Abbott"},"message":"spi: spidev: fix possible arithmetic overflow for multi-transfer message\n\ncommit f20fbaad7620af2df36a1f9d1c9ecf48ead5b747 upstream.\n\n`spidev_message()` sums the lengths of the individual SPI transfers to\ndetermine the overall SPI message length.  It restricts the total\nlength, returning an error if too long, but it does not check for\narithmetic overflow.  For example, if the SPI message consisted of two\ntransfers and the first has a length of 10 and the second has a length\nof (__u32)(-1), the total length would be seen as 9, even though the\nsecond transfer is actually very long.  If the second transfer specifies\na null `rx_buf` and a non-null `tx_buf`, the `copy_from_user()` could\noverrun the spidev's pre-allocated tx buffer before it reaches an\ninvalid user memory address.  Fix it by checking that neither the total\nnor the individual transfer lengths exceed the maximum allowed value.\n\nThanks to Dan Carpenter for reporting the potential integer overflow.\n\nChange-Id: I9f7065666921d98222483a5acccc9ae6d1b08405\nSigned-off-by: Ian Abbott <abbotti@mev.co.uk>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nSigned-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>","distinct":true,"url":"https://api.github.com/repos/DirtyUnicorns/android_kernel_htc_flounder/commits/d5357878aeda050b80cd7befe50244ad3c5cf81a"}]}