Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 62f7f9cb authored by Mohammed Nayeem Ur Rahman's avatar Mohammed Nayeem Ur Rahman
Browse files

msm: adsprpc: Put upper limit on IOMMU mapping size 



Place appropriate validation checks for IOMMU mapping size. Without
these checks, a mapping in an invalid kernel space could be created
and fail during access.

Change-Id: I95c28bc1e287a6a89256b62a4dd3a387351dc6ad
Acked-by: default avatarMaitreyi Gupta <maitreyi@qti.qualcomm.com>
Signed-off-by: default avatarMohammed Nayeem Ur Rahman <mohara@codeaurora.org>
parent 2e88452c

drivers/char/adsprpc.c

+12 −3
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ 
#define FASTRPC_STATIC_HANDLE_MAX (20)

#define FASTRPC_LATENCY_CTRL_ENB  (1)



#define MAX_SIZE_LIMIT (0x78000000)

#define INIT_FILELEN_MAX (2*1024*1024)

#define INIT_MEMLEN_MAX  (8*1024*1024)
@@ -937,6 +938,12 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
			map->size = buf_page_size(len);

		}



		VERIFY(err, map->size >= len && map->size < MAX_SIZE_LIMIT);

		if (err) {

			err = -EFAULT;

			goto bail;

		}



		vmid = fl->apps->channel[fl->cid].vmid;

		if (!sess->smmu.enabled && !vmid) {

			VERIFY(err, map->phys >= me->range.addr &&
@@ -980,9 +987,11 @@ static int fastrpc_buf_alloc(struct fastrpc_file *fl, size_t size, 
	struct fastrpc_buf *buf = NULL, *fr = NULL;

	struct hlist_node *n;



	VERIFY(err, size > 0);

	if (err)

	VERIFY(err, size > 0 && size < MAX_SIZE_LIMIT);

	if (err) {

		err = -EFAULT;

		goto bail;

	}



	if (!remote) {

		/* find the smallest buffer that fits in the cache */
@@ -4046,7 +4055,7 @@ static int fastrpc_cb_probe(struct device *dev) 
		start = 0x60000000;

	VERIFY(err, !IS_ERR_OR_NULL(sess->smmu.mapping =

				arm_iommu_create_mapping(&platform_bus_type,

						start, 0x78000000)));

						start, MAX_SIZE_LIMIT)));

	if (err)

		goto bail;