policy: add KDBUS_ITEMS_END() check

8 files changed, 12 insertions, 8 deletions

diff --git a/bus.c b/bus.c
index d10bbba2d76..a2ec7a93210 100644
--- a/bus.c
+++ b/bus.c
@@ -375,7 +375,7 @@ int kdbus_bus_make_user(const struct kdbus_cmd_make *make,
 		}
 	}
 
-	if (!KDBUS_ITEMS_END(item, make))
+	if (!KDBUS_ITEMS_END(item, make->items, KDBUS_ITEMS_SIZE(make, items)))
 		return -EINVAL;
 
 	if (!n)
diff --git a/domain.c b/domain.c
index f9fb48df003..6098f67cd33 100644
--- a/domain.c
+++ b/domain.c
@@ -397,7 +397,7 @@ int kdbus_domain_make_user(struct kdbus_cmd_make *cmd, char **name)
 		}
 	}
 
-	if (!KDBUS_ITEMS_END(item, cmd))
+	if (!KDBUS_ITEMS_END(item, cmd->items, KDBUS_ITEMS_SIZE(cmd, items)))
 		return -EINVAL;
 
 	if (!name)
diff --git a/endpoint.c b/endpoint.c
index 6d38b2dffb0..826d7d98e38 100644
--- a/endpoint.c
+++ b/endpoint.c
@@ -300,7 +300,7 @@ int kdbus_ep_make_user(const struct kdbus_cmd_make *make, char **name)
 		}
 	}
 
-	if (!KDBUS_ITEMS_END(item, make))
+	if (!KDBUS_ITEMS_END(item, make->items, KDBUS_ITEMS_SIZE(make, items)))
 		return -EINVAL;
 
 	if (!n)
diff --git a/handle.c b/handle.c
index 748885f13db..bfded4c6918 100644
--- a/handle.c
+++ b/handle.c
@@ -287,7 +287,7 @@ static int kdbus_handle_memfd(void __user *buf)
 		}
 	}
 
-	if (!KDBUS_ITEMS_END(item, m)) {
+	if (!KDBUS_ITEMS_END(item, m->items, KDBUS_ITEMS_SIZE(m, items))) {
 		ret = -EINVAL;
 		goto exit;
 	}
diff --git a/match.c b/match.c
index e6f93abcd62..04b6a0f5fbf 100644
--- a/match.c
+++ b/match.c
@@ -492,7 +492,8 @@ int kdbus_match_db_add(struct kdbus_conn *conn,
 		list_add_tail(&rule->rules_entry, &entry->rules_list);
 	}
 
-	if (ret == 0 && !KDBUS_ITEMS_END(item, cmd))
+	if (ret == 0 &&
+	    !KDBUS_ITEMS_END(item, cmd->items, KDBUS_ITEMS_SIZE(cmd, items)))
 		ret = -EINVAL;
 
 	if (ret == 0)
diff --git a/message.c b/message.c
index 3b9d373b100..1a88bf1f436 100644
--- a/message.c
+++ b/message.c
@@ -210,7 +210,7 @@ static int kdbus_msg_scan_items(struct kdbus_conn *conn,
 		}
 	}
 
-	if (!KDBUS_ITEMS_END(item, msg))
+	if (!KDBUS_ITEMS_END(item, msg->items, KDBUS_ITEMS_SIZE(msg, items)))
 		return -EINVAL;
 
 	/* name is needed if no ID is given */
diff --git a/policy.c b/policy.c
index 551d22722db..f5910719e03 100644
--- a/policy.c
+++ b/policy.c
@@ -614,6 +614,9 @@ int kdbus_policy_set(struct kdbus_policy_db *db,
 		}
 	}
 
+	if (!KDBUS_ITEMS_END(item, items, items_size))
+		return -EINVAL;
+
 	if (e) {
 		ret = kdbus_policy_add_one(db, e);
 		if (ret < 0)
diff --git a/util.h b/util.h
index ad337b90469..54530e56cb2 100644
--- a/util.h
+++ b/util.h
@@ -42,8 +42,8 @@
 #define KDBUS_ITEMS_FOREACH(item, head, first)				\
 	KDBUS_ITEMS_FOREACH_SIZE(item, (head)->first,			\
 				 KDBUS_ITEMS_SIZE(head, first))
-#define KDBUS_ITEMS_END(item, head)					\
-	((u8 *)item == ((u8 *)(head) + KDBUS_ALIGN8((head)->size)))
+#define KDBUS_ITEMS_END(item, items, size)				\
+	((u8 *)item == ((u8 *)(items) + KDBUS_ALIGN8(size)))
 
 /**
  * kdbus_size_get_user - read the size variable from user memory