Merge "msm: ADSPRPC: Buffer length to be copied is truncated" (47451710) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/char/adsprpc.c

+12 −2

Original line number	Original line	Diff line number	Diff line
	@@ -979,6 +979,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
	/* calculate len requreed for copying */		/* calculate len requreed for copying */
	for (oix = 0; oix < inbufs + outbufs; ++oix) {		for (oix = 0; oix < inbufs + outbufs; ++oix) {
	int i = ctx->overps[oix]->raix;		int i = ctx->overps[oix]->raix;
			uintptr_t mstart, mend;
	ssize_t len = lpra[i].buf.len;		ssize_t len = lpra[i].buf.len;
	if (!len)		if (!len)
	continue;		continue;
	@@ -986,7 +987,15 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
	continue;		continue;
	if (ctx->overps[oix]->offset == 0)		if (ctx->overps[oix]->offset == 0)
	copylen = ALIGN(copylen, BALIGN);		copylen = ALIGN(copylen, BALIGN);
	copylen += ctx->overps[oix]->mend - ctx->overps[oix]->mstart;		mstart = ctx->overps[oix]->mstart;
			mend = ctx->overps[oix]->mend;
			VERIFY(err, (mend - mstart) <= LONG_MAX);
			if (err)
			goto bail;
			copylen += mend - mstart;
			VERIFY(err, copylen >= 0);
			if (err)
			goto bail;
	}		}
	ctx->used = copylen;		ctx->used = copylen;

	@@ -1051,7 +1060,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
	for (oix = 0; oix < inbufs + outbufs; ++oix) {		for (oix = 0; oix < inbufs + outbufs; ++oix) {
	int i = ctx->overps[oix]->raix;		int i = ctx->overps[oix]->raix;
	struct fastrpc_mmap *map = ctx->maps[i];		struct fastrpc_mmap *map = ctx->maps[i];
	int mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart;		ssize_t mlen;
	uint64_t buf;		uint64_t buf;
	ssize_t len = lpra[i].buf.len;		ssize_t len = lpra[i].buf.len;
	if (!len)		if (!len)
	@@ -1062,6 +1071,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
	rlen -= ALIGN(args, BALIGN) - args;		rlen -= ALIGN(args, BALIGN) - args;
	args = ALIGN(args, BALIGN);		args = ALIGN(args, BALIGN);
	}		}
			mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart;
	VERIFY(err, rlen >= mlen);		VERIFY(err, rlen >= mlen);
	if (err)		if (err)
	goto bail;		goto bail;