Merge "msm: adsprpc: Fix array index underflow problem" (be1961a6) · Commits · e / devices / android_kernel_xiaomi_nabu

drivers/char/adsprpc.c

+44 −23

Original line number	Diff line number	Diff line
		@@ -706,12 +706,23 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
		{
		struct fastrpc_apps *me = &gfa;
		struct fastrpc_file *fl;
		int vmid;
		int vmid, cid = -1, err = 0;
		struct fastrpc_session_ctx *sess;

		if (!map)
		return;
		fl = map->fl;
		if (fl && !(map->flags == ADSP_MMAP_HEAP_ADDR \|\|
		map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR)) {
		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		pr_err("adsprpc: ERROR:%s, Invalid channel id: %d, err:%d",
		__func__, cid, err);
		return;
		}
		}
		if (map->flags == ADSP_MMAP_HEAP_ADDR \|\|
		map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
		map->refs--;
		@@ -783,20 +794,21 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
		struct fastrpc_apps *me = &gfa;
		struct fastrpc_session_ctx *sess;
		struct fastrpc_apps *apps = fl->apps;
		int cid = fl->cid;
		struct fastrpc_channel_ctx *chan = NULL;
		struct fastrpc_mmap *map = NULL;
		dma_addr_t region_phys = 0;
		void *region_vaddr = NULL;
		unsigned long flags;
		int err = 0, vmid, sgl_index = 0;
		int err = 0, vmid, sgl_index = 0, cid = -1;
		struct scatterlist *sgl = NULL;

		VERIFY(err, cid >= 0 && cid < NUM_CHANNELS);
		if (err)
		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		goto bail;
		}
		chan = &apps->channel[cid];

		if (!fastrpc_mmap_find(fl, fd, va, len, mflags, 1, ppmap))
		return 0;
		map = kzalloc(sizeof(*map), GFP_KERNEL);
		@@ -1829,8 +1841,16 @@ static int fastrpc_invoke_send(struct smq_invoke_ctx *ctx,
		{
		struct smq_msg *msg = &ctx->msg;
		struct fastrpc_file *fl = ctx->fl;
		struct fastrpc_channel_ctx *channel_ctx = &fl->apps->channel[fl->cid];
		int err = 0;
		struct fastrpc_channel_ctx *channel_ctx = NULL;
		int err = 0, cid = -1;

		channel_ctx = &fl->apps->channel[fl->cid];
		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		goto bail;
		}

		mutex_lock(&channel_ctx->smd_mutex);
		msg->pid = fl->tgid;
		@@ -1895,11 +1915,22 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
		{
		struct smq_invoke_ctx *ctx = NULL;
		struct fastrpc_ioctl_invoke *invoke = &inv->inv;
		int cid = fl->cid;
		int interrupted = 0;
		int err = 0;
		int err = 0, cid = -1, interrupted = 0;
		struct timespec invoket = {0};
		int64_t *perf_counter = getperfcounter(fl, PERF_COUNT);
		int64_t *perf_counter = NULL;

		cid = fl->cid;
		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
		if (err) {
		err = -ECHRNG;
		goto bail;
		}
		VERIFY(err, fl->sctx != NULL);
		if (err) {
		err = -EBADR;
		goto bail;
		}
		perf_counter = getperfcounter(fl, PERF_COUNT);

		if (fl->profile)
		getnstimeofday(&invoket);
		@@ -1913,14 +1944,6 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode,
		}
		}

		VERIFY(err, fl->cid >= 0 && fl->cid < NUM_CHANNELS && fl->sctx != NULL);
		if (err) {
		pr_err("adsprpc: ERROR: %s: user application %s domain is not set\n",
		__func__, current->comm);
		err = -EBADR;
		goto bail;
		}

		if (!kernel) {
		VERIFY(err, 0 == context_restore_interrupted(fl, inv,
		&ctx));
		@@ -3238,8 +3261,7 @@ static const struct file_operations debugfs_fops = {
		static int fastrpc_channel_open(struct fastrpc_file *fl)
		{
		struct fastrpc_apps *me = &gfa;
		int cid, err = 0;

		int cid = -1, err = 0;

		VERIFY(err, fl && fl->sctx && fl->cid >= 0 && fl->cid < NUM_CHANNELS);
		if (err) {
		@@ -3249,7 +3271,6 @@ static int fastrpc_channel_open(struct fastrpc_file *fl)
		return err;
		}
		cid = fl->cid;

		mutex_lock(&me->channel[cid].rpmsg_mutex);
		VERIFY(err, NULL != me->channel[cid].rpdev);
		if (err) {