Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 77275d9b authored by Mohammed Nayeem Ur Rahman's avatar Mohammed Nayeem Ur Rahman Committed by Gerrit - the friendly Code Review server
Browse files

msm: adsprpc: Put upper limit on IOMMU mapping size 



Place appropriate validation checks for IOMMU mapping size. Without
these checks, a mapping in an invalid kernel space could be created
and fail during access.

Change-Id: I0783834c09a5f7c37abfb29e2f098fbc86677ff2
Acked-by: default avatarMaitreyi Gupta <maitreyi@qti.qualcomm.com>
Signed-off-by: default avatarMohammed Nayeem Ur Rahman <mohara@codeaurora.org>
parent 4e1c68c5

drivers/char/adsprpc.c

+23 −3
Original line number Diff line number Diff line
@@ -384,6 +384,7 @@ struct fastrpc_apps { 
	uint64_t jobid[NUM_CHANNELS];

	struct wakeup_source *wake_source;

	struct qos_cores silvercores;

	uint32_t max_size_limit;

};



struct fastrpc_mmap {
@@ -1075,6 +1076,14 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
			goto bail;

		}



		VERIFY(err, map->size >= len && map->size < me->max_size_limit);

		if (err) {

			err = -EFAULT;

			pr_err("adsprpc: %s: invalid map size 0x%zx len 0x%zx\n",

				__func__, map->size, len);

			goto bail;

		}



		vmid = fl->apps->channel[fl->cid].vmid;

		if (!sess->smmu.enabled && !vmid) {

			VERIFY(err, map->phys >= me->range.addr &&
@@ -1116,12 +1125,17 @@ static int fastrpc_buf_alloc(struct fastrpc_file *fl, size_t size, 
			int remote, struct fastrpc_buf **obuf)

{

	int err = 0, vmid;

	struct fastrpc_apps *me = &gfa;

	struct fastrpc_buf *buf = NULL, *fr = NULL;

	struct hlist_node *n;



	VERIFY(err, size > 0);

	if (err)

	VERIFY(err, size > 0 && size < me->max_size_limit);

	if (err) {

		err = -EFAULT;

		pr_err("adsprpc: %s: invalid allocation size 0x%zx\n",

			__func__, size);

		goto bail;

	}



	if (!remote) {

		/* find the smallest buffer that fits in the cache */
@@ -4611,9 +4625,11 @@ static int fastrpc_cb_probe(struct device *dev) 
	struct fastrpc_channel_ctx *chan;

	struct fastrpc_session_ctx *sess;

	struct of_phandle_args iommuspec;

	struct fastrpc_apps *me = &gfa;

	const char *name;

	int err = 0, cid = -1, i = 0;

	u32 sharedcb_count = 0, j = 0;

	uint32_t dma_addr_pool[2] = {0, 0};



	VERIFY(err, NULL != (name = of_get_property(dev->of_node,

					 "label", NULL)));
@@ -4660,6 +4676,11 @@ static int fastrpc_cb_probe(struct device *dev) 
	dma_set_max_seg_size(sess->smmu.dev, DMA_BIT_MASK(32));

	dma_set_seg_boundary(sess->smmu.dev, (unsigned long)DMA_BIT_MASK(64));



	of_property_read_u32_array(dev->of_node, "qcom,iommu-dma-addr-pool",

			dma_addr_pool, 2);

	me->max_size_limit = (dma_addr_pool[1] == 0 ? 0x78000000 :

			dma_addr_pool[1]);



	if (of_get_property(dev->of_node, "shared-cb", NULL) != NULL) {

		err = of_property_read_u32(dev->of_node, "shared-cb",

				&sharedcb_count);
@@ -4799,7 +4820,6 @@ static int fastrpc_probe(struct platform_device *pdev) 
		init_qos_cores_list(dev, "qcom,qos-cores",

							&me->silvercores);





		of_property_read_u32(dev->of_node, "qcom,rpc-latency-us",

			&me->latency);

		if (of_get_property(dev->of_node,