Merge "msm: adsprpc: Fix array index underflow problem" (f2687b22) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/char/adsprpc.c

+37 −14

Original line number	Diff line number	Diff line
		@@ -850,12 +850,23 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
		{
		struct fastrpc_apps *me = &gfa;
		struct fastrpc_file *fl;
		int vmid;
		int vmid, cid = -1, err = 0;
		struct fastrpc_session_ctx *sess;

		if (!map)
		return;
		fl = map->fl;
		if (fl && !(map->flags == ADSP_MMAP_HEAP_ADDR \|\|
		map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR)) {
		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		pr_err("adsprpc: ERROR:%s, Invalid channel id: %d, err:%d\n",
		__func__, cid, err);
		return;
		}
		}
		if (map->flags == ADSP_MMAP_HEAP_ADDR \|\|
		map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
		map->refs--;
		@@ -2110,8 +2121,16 @@ static int fastrpc_invoke_send(struct smq_invoke_ctx *ctx,
		{
		struct smq_msg *msg = &ctx->msg;
		struct fastrpc_file *fl = ctx->fl;
		struct fastrpc_channel_ctx *channel_ctx = &fl->apps->channel[fl->cid];
		int err = 0;
		struct fastrpc_channel_ctx *channel_ctx = NULL;
		int err = 0, cid = -1;

		channel_ctx = &fl->apps->channel[fl->cid];
		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		goto bail;
		}

		mutex_lock(&channel_ctx->smd_mutex);
		msg->pid = fl->tgid;
		@@ -2308,10 +2327,23 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
		{
		struct smq_invoke_ctx *ctx = NULL;
		struct fastrpc_ioctl_invoke *invoke = &inv->inv;
		int err = 0, interrupted = 0, cid = fl->cid;
		int err = 0, interrupted = 0, cid = -1;
		struct timespec64 invoket = {0};
		int64_t *perf_counter = NULL;

		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		goto bail;
		}
		VERIFY(err, fl->sctx != NULL);
		if (err) {
		pr_err("adsprpc: ERROR: %s: user application %s domain is not set\n",
		__func__, current->comm);
		err = -EBADR;
		goto bail;
		}
		if (fl->profile) {
		perf_counter = getperfcounter(fl, PERF_COUNT);
		ktime_get_real_ts64(&invoket);
		@@ -2329,15 +2361,6 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
		}
		}

		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS &&
		fl->sctx != NULL);
		if (err) {
		pr_err("adsprpc: ERROR: %s: kernel session not initialized yet for %s\n",
		__func__, current->comm);
		err = EBADR;
		goto bail;
		}

		if (!kernel) {
		err = context_restore_interrupted(fl, inv, &ctx);
		if (err)
		@@ -3919,7 +3942,7 @@ static const struct file_operations debugfs_fops = {
		static int fastrpc_channel_open(struct fastrpc_file *fl)
		{
		struct fastrpc_apps *me = &gfa;
		int cid, err = 0;
		int cid = -1, err = 0;

		VERIFY(err, fl && fl->sctx && fl->cid >= 0 && fl->cid < NUM_CHANNELS);
		if (err) {