Merge "msm: ADSPRPC: validate dma phy address after mapping" (a12154b8) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/char/adsprpc.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -807,13 +807,24 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
		goto bail;
		}
		map->phys = sg_dma_address(map->table->sgl);

		if (sess->smmu.cb) {
		map->phys += ((uint64_t)sess->smmu.cb << 32);
		map->size = sg_dma_len(map->table->sgl);
		} else {
		map->size = buf_page_size(len);
		}

		vmid = fl->apps->channel[fl->cid].vmid;
		if (!sess->smmu.enabled && !vmid) {
		VERIFY(err, map->phys >= me->range.addr &&
		map->phys + map->size <=
		me->range.addr + me->range.size);
		if (err) {
		pr_err("adsprpc: mmap fail out of range\n");
		goto bail;
		}
		}
		if (vmid) {
		int srcVM[1] = {VMID_HLOS};
		int destVM[2] = {VMID_HLOS, vmid};
		@@ -3414,6 +3425,8 @@ static int fastrpc_probe(struct platform_device *pdev)
		srcVM, 1, destVM, destVMperm, 4));
		if (err)
		goto bail;
		me->range.addr = range.addr;
		me->range.size = range.size;
		}
		return 0;
		}