Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 385213f6 authored by Jeya R's avatar Jeya R
Browse files

msm: adsprpc: null pointer check for sctx 



Adding a null pointer for sctx before dereferencing.

Change-Id: I1497eea2b9cb7bb75481246df47269796aff182d
Acked-by: default avatarMaitreyi Gupta <maitreyi@qti.qualcomm.com>
Signed-off-by: Jeya R <jeyr@codeaurora.org> Please enter the commit message for your changes. Lines starting
parent 26138762

drivers/char/adsprpc.c

+17 −5
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.

 * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.

 */

#include <linux/dma-buf.h>

#include <linux/dma-mapping.h>
@@ -652,7 +652,7 @@ static inline int poll_on_early_response(struct smq_invoke_ctx *ctx) 
static void fastrpc_buf_free(struct fastrpc_buf *buf, int cache)

{

	struct fastrpc_file *fl = buf == NULL ? NULL : buf->fl;

	int vmid;

	int vmid, err = 0;



	if (!fl)

		return;
@@ -673,6 +673,9 @@ static void fastrpc_buf_free(struct fastrpc_buf *buf, int cache) 
		int destVM[1] = {VMID_HLOS};

		int destVMperm[1] = {PERM_READ | PERM_WRITE | PERM_EXEC};



		VERIFY(err, fl->sctx != NULL);

		if (err)

			goto bail;

		if (fl->sctx->smmu.cb)

			buf->phys &= ~((uint64_t)fl->sctx->smmu.cb << 32);

		vmid = fl->apps->channel[fl->cid].vmid;
@@ -686,6 +689,7 @@ static void fastrpc_buf_free(struct fastrpc_buf *buf, int cache) 
		dma_free_attrs(fl->sctx->smmu.dev, buf->size, buf->virt,

					buf->phys, buf->dma_attr);

	}

bail:

	kfree(buf);

}
@@ -1195,6 +1199,12 @@ static int fastrpc_buf_alloc(struct fastrpc_file *fl, size_t size, 
	buf->flags = rflags;

	buf->raddr = 0;

	buf->remote = 0;



	VERIFY(err, fl && fl->sctx != NULL);

	if (err) {

		err = -EBADR;

		goto bail;

	}

	buf->virt = dma_alloc_attrs(fl->sctx->smmu.dev, buf->size,

						(dma_addr_t *)&buf->phys,

						GFP_KERNEL, buf->dma_attr);
@@ -1904,7 +1914,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
			continue;

		if (map && map->uncached)

			continue;

		if (ctx->fl->sctx->smmu.coherent &&

		if (ctx->fl->sctx && ctx->fl->sctx->smmu.coherent &&

			!(map && (map->attr & FASTRPC_ATTR_NON_COHERENT)))

			continue;

		if (map && (map->attr & FASTRPC_ATTR_COHERENT))
@@ -2058,7 +2068,7 @@ static void inv_args(struct smq_invoke_ctx *ctx) 
			continue;

		if (!rpra[over].buf.len)

			continue;

		if (ctx->fl->sctx->smmu.coherent &&

		if (ctx->fl && ctx->fl->sctx && ctx->fl->sctx->smmu.coherent &&

			!(map && (map->attr & FASTRPC_ATTR_NON_COHERENT)))

			continue;

		if (map && (map->attr & FASTRPC_ATTR_COHERENT))
@@ -4168,8 +4178,10 @@ static int fastrpc_get_info(struct fastrpc_file *fl, uint32_t *info) 
			goto bail;

	}

	VERIFY(err, fl->sctx != NULL);

	if (err)

	if (err) {

		err = -EBADR;

		goto bail;

	}

	*info = (fl->sctx->smmu.enabled ? 1 : 0);

bail:

	return err;