Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c638be9b authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: ADSPRPC: Validate rpra to avoid Null pointer dereference"

parents 2a5b9922 eede053d

drivers/char/adsprpc.c

+3 −3
Original line number Diff line number Diff line
@@ -1253,7 +1253,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	/* copy non ion buffers */

	PERF(ctx->fl->profile, ctx->fl->perf.copy,

	rlen = copylen - metalen;

	for (oix = 0; oix < inbufs + outbufs; ++oix) {

	for (oix = 0; rpra && oix < inbufs + outbufs; ++oix) {

		int i = ctx->overps[oix]->raix;

		struct fastrpc_mmap *map = ctx->maps[i];

		size_t mlen;
@@ -1304,7 +1304,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
		if (map && (map->attr & FASTRPC_ATTR_COHERENT))

			continue;



		if (rpra[i].buf.len && ctx->overps[oix]->mstart) {

		if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart) {

			if (map && map->handle)

				msm_ion_do_cache_op(ctx->fl->apps->client,

					map->handle,
@@ -1320,7 +1320,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	PERF_END);



	inh = inbufs + outbufs;

	for (i = 0; i < REMOTE_SCALARS_INHANDLES(sc); i++) {

	for (i = 0; rpra && i < REMOTE_SCALARS_INHANDLES(sc); i++) {

		rpra[inh + i].buf.pv = ptr_to_uint64(ctx->lpra[inh + i].buf.pv);

		rpra[inh + i].buf.len = ctx->lpra[inh + i].buf.len;

		rpra[inh + i].h = ctx->lpra[inh + i].h;