Merge "msm: ADSPRPC: Fix to avoid race condition and use after free" (df709e86) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/char/adsprpc.c

+14 −5

Original line number	Diff line number	Diff line
		@@ -3213,7 +3213,7 @@ static int fastrpc_internal_munmap(struct fastrpc_file *fl,
		pr_err("adsprpc: ERROR: %s: user application %s trying to unmap without initialization\n",
		__func__, current->comm);
		err = EBADR;
		goto bail;
		return err;
		}
		mutex_lock(&fl->internal_map_mutex);

		@@ -3262,6 +3262,11 @@ static int fastrpc_internal_munmap(struct fastrpc_file *fl,
		return err;
		}

		/*
		* fastrpc_internal_munmap_fd can only be used for buffers
		* mapped with persist attributes. This can only be called
		* once for any persist buffer
		*/
		static int fastrpc_internal_munmap_fd(struct fastrpc_file *fl,
		struct fastrpc_ioctl_munmap_fd *ud)
		{
		@@ -3270,14 +3275,15 @@ static int fastrpc_internal_munmap_fd(struct fastrpc_file *fl,

		VERIFY(err, (fl && ud));
		if (err)
		goto bail;
		return err;
		VERIFY(err, fl->dsp_proc_init == 1);
		if (err) {
		pr_err("adsprpc: ERROR: %s: user application %s trying to unmap without initialization\n",
		__func__, current->comm);
		err = EBADR;
		goto bail;
		return err;
		}
		mutex_lock(&fl->internal_map_mutex);
		mutex_lock(&fl->map_mutex);
		if (fastrpc_mmap_find(fl, ud->fd, ud->va, ud->len, 0, 0, &map)) {
		pr_err("adsprpc: mapping not found to unmap fd 0x%x, va 0x%llx, len 0x%x\n",
		@@ -3287,10 +3293,13 @@ static int fastrpc_internal_munmap_fd(struct fastrpc_file *fl,
		mutex_unlock(&fl->map_mutex);
		goto bail;
		}
		if (map)
		if (map && (map->attr & FASTRPC_ATTR_KEEP_MAP)) {
		map->attr = map->attr & (~FASTRPC_ATTR_KEEP_MAP);
		fastrpc_mmap_free(map, 0);
		}
		mutex_unlock(&fl->map_mutex);
		bail:
		mutex_unlock(&fl->internal_map_mutex);
		return err;
		}

		@@ -3309,7 +3318,7 @@ static int fastrpc_internal_mmap(struct fastrpc_file *fl,
		pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n",
		__func__, current->comm);
		err = EBADR;
		goto bail;
		return err;
		}
		mutex_lock(&fl->internal_map_mutex);
		if ((ud->flags == ADSP_MMAP_ADD_PAGES) \|\|