Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5404e350 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ADSPRPC: Copy process name buffer to kernel space"

parents d573c819 7fbbf8a3

drivers/char/adsprpc.c

+9 −1
Original line number Diff line number Diff line
@@ -1585,6 +1585,7 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
	struct fastrpc_ioctl_init *init = &uproc->init;

	struct smq_phy_page pages[1];

	struct fastrpc_mmap *file = 0, *mem = 0;

	char *proc_name = NULL;

	int srcVM[1] = {VMID_HLOS};

	int destVM[1] = {VMID_ADSP_Q6};

	int destVMperm[1] = {PERM_READ | PERM_WRITE | PERM_EXEC};
@@ -1680,12 +1681,18 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
		uint64_t phys = 0;

		ssize_t size = 0;

		int fds[3];

		char *proc_name = (unsigned char *)init->file;

		struct {

			int pgid;

			int namelen;

			int pageslen;

		} inbuf;

		VERIFY(err, proc_name = kzalloc(init->filelen, GFP_KERNEL));

		if (err)

			goto bail;

		VERIFY(err, 0 == copy_from_user(proc_name,

			(unsigned char *)init->file, init->filelen));

		if (err)

			goto bail;

		inbuf.pgid = current->tgid;

		inbuf.namelen = strlen(proc_name)+1;

		inbuf.pageslen = 0;
@@ -1738,6 +1745,7 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
		err = -ENOTTY;

	}

bail:

	kfree(proc_name);

	if (err && (init->flags == FASTRPC_INIT_CREATE_STATIC))

		me->staticpd_flags = 0;

	if (mem && err) {