diff --git a/drivers/misc/nvsciipc/nvsciipc.c b/drivers/misc/nvsciipc/nvsciipc.c index ca6f016a..08bad0d6 100644 --- a/drivers/misc/nvsciipc/nvsciipc.c +++ b/drivers/misc/nvsciipc/nvsciipc.c @@ -659,7 +659,7 @@ static int nvsciipc_ioctl_set_db(struct nvsciipc *ctx, unsigned int cmd, if (!access_ok(user_db.entry, ctx->num_eps * sizeof(struct nvsciipc_config_entry *))) { - ERR("invalid user-space pointer: %p\n", user_db.entry); + ERR("invalid user-space DB entry ptr: %p\n", user_db.entry); ret = -EFAULT; goto ptr_error; } @@ -703,6 +703,12 @@ static int nvsciipc_ioctl_set_db(struct nvsciipc *ctx, unsigned int cmd, goto ptr_error; } + if (!access_ok(entry_ptr[i], sizeof(struct nvsciipc_config_entry))) { + ERR("invalid user-space CFG entry ptr: %p\n", entry_ptr[i]); + ret = -EFAULT; + goto ptr_error; + } + ret = copy_from_user(ctx->db[i], (void __user *)entry_ptr[i], sizeof(struct nvsciipc_config_entry)); if (ret < 0) {