Merge "msm: adsprpc: Validate the CID" (b2e71fbd) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/char/adsprpc.c

+8 −1

Original line number	Diff line number	Diff line
		@@ -118,6 +118,9 @@
		#define GET_TABLE_IDX_FROM_CTXID(ctxid) \
		((ctxid & FASTRPC_CTX_TABLE_IDX_MASK) >> FASTRPC_CTX_TABLE_IDX_POS)

		#define VALID_FASTRPC_CID(cid) \
		(cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS)

		/* Reserve few entries in context table for critical kernel and static RPC
		* calls to avoid user invocations from exhausting all entries.
		*/
		@@ -2066,7 +2069,11 @@ static int context_alloc(struct fastrpc_file *fl, uint32_t kernel,
		if (err)
		goto bail;
		}

		VERIFY(err, VALID_FASTRPC_CID(cid));
		if (err) {
		err = -ECHRNG;
		goto bail;
		}
		chan = &me->channel[cid];

		spin_lock_irqsave(&chan->ctxlock, irq_flags);