Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c230bd73 authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu
Browse files

msm: ADSPRPC: Validate rpra to avoid Null pointer dereference 



In get_args function their is no NULL pointer check for rpra 
variable, that might lead to null pointer dereference. Add 
condition to verify.

Change-Id: I0789e8ea875221de5809598419bc7f842aa3e22e
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 2467fe92

drivers/char/adsprpc.c

+2 −2
Original line number Diff line number Diff line
@@ -1381,7 +1381,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	/* copy non ion buffers */

	PERF(ctx->fl->profile, GET_COUNTER(perf_counter, PERF_COPY),

	rlen = copylen - metalen;

	for (oix = 0; oix < inbufs + outbufs; ++oix) {

	for (oix = 0; rpra && oix < inbufs + outbufs; ++oix) {

		int i = ctx->overps[oix]->raix;

		struct fastrpc_mmap *map = ctx->maps[i];

		size_t mlen;
@@ -1432,7 +1432,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
		if (map && (map->attr & FASTRPC_ATTR_COHERENT))

			continue;



		if (rpra[i].buf.len && ctx->overps[oix]->mstart)

		if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart)

			dmac_flush_range(uint64_to_ptr(rpra[i].buf.pv),

			uint64_to_ptr(rpra[i].buf.pv + rpra[i].buf.len));

	}