platform/chrome: cros_ec_dev - Fix security issue

Prevent memory scribble by checking that ioctl buffer size parameters
are sane.
Without this check, on 32 bits system, if .insize = 0xffffffff - 20 and
.outsize the amount to scribble, we would overflow, allocate a small
amounts and be able to write outside of the malloc'ed area.
Adding a hard limit allows argument checking of the ioctl. With the
current EC, it is expected .insize and .outsize to be at around 512 bytes
or less.

Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Olof Johansson <olof@lixom.net>

1 files changed, 4 insertions, 2 deletions

diff --git a/include/linux/mfd/cros_ec.h b/include/linux/mfd/cros_ec.h
index a677c2bd485c..64184d27e3cd 100644
--- a/include/linux/mfd/cros_ec.h
+++ b/include/linux/mfd/cros_ec.h
@@ -50,9 +50,11 @@ enum {
                                         EC_MSG_TX_TRAILER_BYTES,
         EC_MSG_RX_PROTO_BYTES   = 3,
 
-        /* Max length of messages */
-        EC_MSG_BYTES            = EC_PROTO2_MAX_PARAM_SIZE +
+        /* Max length of messages for proto 2*/
+        EC_PROTO2_MSG_BYTES             = EC_PROTO2_MAX_PARAM_SIZE +
                                         EC_MSG_TX_PROTO_BYTES,
+
+        EC_MAX_MSG_BYTES                = 64 * 1024,
 };
 
 /*