Merge "msm: adsprpc: Check size with length passed by client" (f8412a99) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/char/adsprpc.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -1070,6 +1070,10 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
		}
		trace_fastrpc_dma_map(fl->cid, fd, map->phys, map->size,
		len, mflags, map->attach->dma_map_attrs);
		if (map->size < len) {
		err = -EFAULT;
		goto bail;
		}

		vmid = fl->apps->channel[fl->cid].vmid;
		if (!sess->smmu.enabled && !vmid) {