Commit 94190fc1 authored Mar 31, 2020 by Mohammed Nayeem Ur Rahman

msm: adsprpc: Check size with length passed by client



Check whether size of fd is greater than or equal to
length passed by client. If its not checked here, client
might access unmapped address on dsp.

Change-Id: I4e176f32b0f263e2f7bf648e03b4ca904479527b
Acked-by: Deepika Singh <dsi@qti.qualcomm.com>
Signed-off-by: Mohammed Nayeem Ur Rahman <mohara@codeaurora.org>

parent 3fda7c70

drivers/char/adsprpc.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -1070,6 +1070,10 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
		}
		trace_fastrpc_dma_map(fl->cid, fd, map->phys, map->size,
		len, mflags, map->attach->dma_map_attrs);
		if (map->size < len) {
		err = -EFAULT;
		goto bail;
		}

		vmid = fl->apps->channel[fl->cid].vmid;
		if (!sess->smmu.enabled && !vmid) {