Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7fbbf8a3 authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu Committed by Gerrit - the friendly Code Review server
Browse files

msm: ADSPRPC: Copy process name buffer to kernel space 



Copy user space process name buffer to kernel space using
copy_from_user.

Change-Id: I5272a42651ac50ddeda3f0f7a4cbd32dbaf495ec
Acked-by: default avatarHimateja Reddy <hmreddy@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 75a9d0fe

drivers/char/adsprpc.c

+9 −1
Original line number Diff line number Diff line
@@ -1584,6 +1584,7 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
	struct fastrpc_ioctl_init *init = &uproc->init;

	struct smq_phy_page pages[1];

	struct fastrpc_mmap *file = 0, *mem = 0;

	char *proc_name = NULL;

	int srcVM[1] = {VMID_HLOS};

	int destVM[1] = {VMID_ADSP_Q6};

	int destVMperm[1] = {PERM_READ | PERM_WRITE | PERM_EXEC};
@@ -1679,12 +1680,18 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
		uint64_t phys = 0;

		ssize_t size = 0;

		int fds[3];

		char *proc_name = (unsigned char *)init->file;

		struct {

			int pgid;

			int namelen;

			int pageslen;

		} inbuf;

		VERIFY(err, proc_name = kzalloc(init->filelen, GFP_KERNEL));

		if (err)

			goto bail;

		VERIFY(err, 0 == copy_from_user(proc_name,

			(unsigned char *)init->file, init->filelen));

		if (err)

			goto bail;

		inbuf.pgid = current->tgid;

		inbuf.namelen = strlen(proc_name)+1;

		inbuf.pageslen = 0;
@@ -1737,6 +1744,7 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
		err = -ENOTTY;

	}

bail:

	kfree(proc_name);

	if (err && (init->flags == FASTRPC_INIT_CREATE_STATIC))

		me->staticpd_flags = 0;

	if (mem && err) {