Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 96e8f54f authored by Kyle Yan's avatar Kyle Yan Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ADSPRPC: Check for buffer overflow condition" into msm-4.8

parents 9824badd 9466d67c

drivers/char/adsprpc.c

+14 −4
Original line number Original line Diff line number Diff line
@@ -672,9 +672,9 @@ static int overlap_ptr_cmp(const void *a, const void *b) 
	return st == 0 ? ed : st;

	return st == 0 ? ed : st;

}

}





static void context_build_overlap(struct smq_invoke_ctx *ctx)

static int context_build_overlap(struct smq_invoke_ctx *ctx)

{

{

	int i;

	int i, err = 0;

	remote_arg_t *lpra = ctx->lpra;

	remote_arg_t *lpra = ctx->lpra;

	int inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);

	int inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);

	int outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);

	int outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -684,6 +684,11 @@ static void context_build_overlap(struct smq_invoke_ctx *ctx) 
	for (i = 0; i < nbufs; ++i) {

	for (i = 0; i < nbufs; ++i) {

		ctx->overs[i].start = (uintptr_t)lpra[i].buf.pv;

		ctx->overs[i].start = (uintptr_t)lpra[i].buf.pv;

		ctx->overs[i].end = ctx->overs[i].start + lpra[i].buf.len;

		ctx->overs[i].end = ctx->overs[i].start + lpra[i].buf.len;

		if (lpra[i].buf.len) {

			VERIFY(err, ctx->overs[i].end > ctx->overs[i].start);

			if (err)

				goto bail;

		}

		ctx->overs[i].raix = i;

		ctx->overs[i].raix = i;

		ctx->overps[i] = &ctx->overs[i];

		ctx->overps[i] = &ctx->overs[i];

	}

	}
@@ -709,6 +714,8 @@ static void context_build_overlap(struct smq_invoke_ctx *ctx) 
			max = *ctx->overps[i];

			max = *ctx->overps[i];

		}

		}

	}

	}

bail:

	return err;

}

}





#define K_COPY_FROM_USER(err, kernel, dst, src, size) \

#define K_COPY_FROM_USER(err, kernel, dst, src, size) \
@@ -781,8 +788,11 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel, 
	}

	}





	ctx->sc = invoke->sc;

	ctx->sc = invoke->sc;

	if (bufs)

	if (bufs) {

		context_build_overlap(ctx);

		VERIFY(err, 0 == context_build_overlap(ctx));

		if (err)

			goto bail;

	}

	ctx->retval = -1;

	ctx->retval = -1;

	ctx->pid = current->pid;

	ctx->pid = current->pid;

	ctx->tgid = current->tgid;

	ctx->tgid = current->tgid;