Merge "msm: ADSPRPC: Protect global remote heap maps" (2fb0fb2c) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/char/adsprpc.c

+6 −0

Original line number	Original line	Diff line number	Diff line
	@@ -578,7 +578,9 @@ static void fastrpc_mmap_add(struct fastrpc_mmap *map)
	map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {		map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
	struct fastrpc_apps *me = &gfa;		struct fastrpc_apps *me = &gfa;

			spin_lock(&me->hlock);
	hlist_add_head(&map->hn, &me->maps);		hlist_add_head(&map->hn, &me->maps);
			spin_unlock(&me->hlock);
	} else {		} else {
	struct fastrpc_file *fl = map->fl;		struct fastrpc_file *fl = map->fl;

	@@ -598,6 +600,7 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
	return -EOVERFLOW;		return -EOVERFLOW;
	if (mflags == ADSP_MMAP_HEAP_ADDR \|\|		if (mflags == ADSP_MMAP_HEAP_ADDR \|\|
	mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {		mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
			spin_lock(&me->hlock);
	hlist_for_each_entry_safe(map, n, &me->maps, hn) {		hlist_for_each_entry_safe(map, n, &me->maps, hn) {
	if (va >= map->va &&		if (va >= map->va &&
	va + len <= map->va + map->len &&		va + len <= map->va + map->len &&
	@@ -608,6 +611,7 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
	break;		break;
	}		}
	}		}
			spin_unlock(&me->hlock);
	} else {		} else {
	hlist_for_each_entry_safe(map, n, &fl->maps, hn) {		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
	if (va >= map->va &&		if (va >= map->va &&
	@@ -653,6 +657,7 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,
	struct hlist_node *n;		struct hlist_node *n;
	struct fastrpc_apps *me = &gfa;		struct fastrpc_apps *me = &gfa;

			spin_lock(&me->hlock);
	hlist_for_each_entry_safe(map, n, &me->maps, hn) {		hlist_for_each_entry_safe(map, n, &me->maps, hn) {
	if (map->raddr == va &&		if (map->raddr == va &&
	map->raddr + map->len == va + len &&		map->raddr + map->len == va + len &&
	@@ -662,6 +667,7 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,
	break;		break;
	}		}
	}		}
			spin_unlock(&me->hlock);
	if (match) {		if (match) {
	*ppmap = match;		*ppmap = match;
	return 0;		return 0;