LWIS Kernel Driver Out-Of-Bounds Write

The lwis driver provides an interface for writing data to dma-buf objects via the LWISIOENTRYWRITETOBUFFER command. In lwisiobufferwrite, the driver performs a memcpy from a kernel-allocated copy of user data into the kernel mapping of a dma-buf. The driver uses the offset and sizeinbytes fields...