Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d01faa36 authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu Committed by Gerrit - the friendly Code Review server
Browse files

msm: adsprpc: Validate channel ID before dereferencing 



Validate channel ID before dereferencing the channel info struct
and  error out if Channel ID is out of bound.

Change-Id: I1b7325d686f6e8699e6f98f529c5dff85cce630d
Acked-by: default avatarThyagarajan Venkatanarayanan <venkatan@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 5219be0f

drivers/char/adsprpc.c

+6 −1
Original line number Diff line number Diff line
@@ -796,7 +796,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
	struct fastrpc_session_ctx *sess;

	struct fastrpc_apps *apps = fl->apps;

	int cid = fl->cid;

	struct fastrpc_channel_ctx *chan = &apps->channel[cid];

	struct fastrpc_channel_ctx *chan = NULL;

	struct fastrpc_mmap *map = NULL;

	dma_addr_t region_phys = 0;

	void *region_vaddr = NULL;
@@ -804,6 +804,11 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
	int err = 0, vmid, sgl_index = 0;

	struct scatterlist *sgl = NULL;



	VERIFY(err, cid >= 0 && cid < NUM_CHANNELS);

	if (err)

		goto bail;

	chan = &apps->channel[cid];



	if (!fastrpc_mmap_find(fl, fd, va, len, mflags, 1, ppmap))

		return 0;

	map = kzalloc(sizeof(*map), GFP_KERNEL);