greybus: svc: fix missing version-request sanity checks

Add missing sanity checks on version-request payload size.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

diff --git a/drivers/staging/greybus/svc.c b/drivers/staging/greybus/svc.c
index 6c1a157..bd04567 100644 (file)
--- a/drivers/staging/greybus/svc.c
+++ b/drivers/staging/greybus/svc.c
@@ -310,6 +310,14 @@ static int gb_svc_version_request(struct gb_operation *op)
        struct gb_protocol_version_request *request;
        struct gb_protocol_version_response *response;
 
+       if (op->request->payload_size < sizeof(*request)) {
+               pr_err("%d: short version request (%zu < %zu)\n",
+                               connection->intf_cport_id,
+                               op->request->payload_size,
+                               sizeof(*request));
+               return -EINVAL;
+       }
+
        request = op->request->payload;
 
        if (request->major > GB_SVC_VERSION_MAJOR) {