Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dfc16676 authored by Mohammed Nayeem Ur Rahman's avatar Mohammed Nayeem Ur Rahman
Browse files

msm: adsprpc: Fix array index underflow problem 



Add check to restrict index underflow.This is to avoid
that it does not access invalid index.

Change-Id: Ib971033c5820ca4dab38ace3b106c7b1b42529e4
Acked-by: default avatarGururaj Chalger <gchalger@qti.qualcomm.com>
Signed-off-by: default avatarMohammed Nayeem Ur Rahman <mohara@codeaurora.org>
parent b2551fe1

drivers/char/adsprpc.c

+44 −23
Original line number Diff line number Diff line
@@ -706,12 +706,23 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags) 
{

	struct fastrpc_apps *me = &gfa;

	struct fastrpc_file *fl;

	int vmid;

	int vmid, cid = -1, err = 0;

	struct fastrpc_session_ctx *sess;



	if (!map)

		return;

	fl = map->fl;

	if (fl && !(map->flags == ADSP_MMAP_HEAP_ADDR ||

				map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR)) {

		cid = fl->cid;

		VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);

		if (err) {

			err = -ECHRNG;

			pr_err("adsprpc: ERROR:%s, Invalid channel id: %d, err:%d",

				__func__, cid, err);

			return;

		}

	}

	if (map->flags == ADSP_MMAP_HEAP_ADDR ||

				map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {

		map->refs--;
@@ -783,20 +794,21 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
	struct fastrpc_apps *me = &gfa;

	struct fastrpc_session_ctx *sess;

	struct fastrpc_apps *apps = fl->apps;

	int cid = fl->cid;

	struct fastrpc_channel_ctx *chan = NULL;

	struct fastrpc_mmap *map = NULL;

	dma_addr_t region_phys = 0;

	void *region_vaddr = NULL;

	unsigned long flags;

	int err = 0, vmid, sgl_index = 0;

	int err = 0, vmid, sgl_index = 0, cid = -1;

	struct scatterlist *sgl = NULL;



	VERIFY(err, cid >= 0 && cid < NUM_CHANNELS);

	if (err)

	cid = fl->cid;

	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);

	if (err) {

		err = -ECHRNG;

		goto bail;

	}

	chan = &apps->channel[cid];



	if (!fastrpc_mmap_find(fl, fd, va, len, mflags, 1, ppmap))

		return 0;

	map = kzalloc(sizeof(*map), GFP_KERNEL);
@@ -1829,8 +1841,16 @@ static int fastrpc_invoke_send(struct smq_invoke_ctx *ctx, 
{

	struct smq_msg *msg = &ctx->msg;

	struct fastrpc_file *fl = ctx->fl;

	struct fastrpc_channel_ctx *channel_ctx = &fl->apps->channel[fl->cid];

	int err = 0;

	struct fastrpc_channel_ctx *channel_ctx = NULL;

	int err = 0, cid = -1;



	channel_ctx = &fl->apps->channel[fl->cid];

	cid = fl->cid;

	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);

	if (err) {

		err = -ECHRNG;

		goto bail;

	}



	mutex_lock(&channel_ctx->smd_mutex);

	msg->pid = fl->tgid;
@@ -1895,11 +1915,22 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode, 
{

	struct smq_invoke_ctx *ctx = NULL;

	struct fastrpc_ioctl_invoke *invoke = &inv->inv;

	int cid = fl->cid;

	int interrupted = 0;

	int err = 0;

	int err = 0, cid = -1, interrupted = 0;

	struct timespec invoket = {0};

	int64_t *perf_counter = getperfcounter(fl, PERF_COUNT);

	int64_t *perf_counter = NULL;



	cid = fl->cid;

	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);

	if (err) {

		err = -ECHRNG;

		goto bail;

	}

	VERIFY(err, fl->sctx != NULL);

	if (err) {

		err = -EBADR;

		goto bail;

	}

	perf_counter = getperfcounter(fl, PERF_COUNT);



	if (fl->profile)

		getnstimeofday(&invoket);
@@ -1913,14 +1944,6 @@ static int fastrpc_internal_invoke(struct fastrpc_file *fl, uint32_t mode, 
		}

	}



	VERIFY(err, fl->cid >= 0 && fl->cid < NUM_CHANNELS && fl->sctx != NULL);

	if (err) {

		pr_err("adsprpc: ERROR: %s: user application %s domain is not set\n",

			__func__, current->comm);

		err = -EBADR;

		goto bail;

	}



	if (!kernel) {

		VERIFY(err, 0 == context_restore_interrupted(fl, inv,

								&ctx));
@@ -3238,8 +3261,7 @@ static const struct file_operations debugfs_fops = { 
static int fastrpc_channel_open(struct fastrpc_file *fl)

{

	struct fastrpc_apps *me = &gfa;

	int cid, err = 0;



	int cid = -1, err = 0;



	VERIFY(err, fl && fl->sctx && fl->cid >= 0 && fl->cid < NUM_CHANNELS);

	if (err) {
@@ -3249,7 +3271,6 @@ static int fastrpc_channel_open(struct fastrpc_file *fl) 
		return err;

	}

	cid = fl->cid;



	mutex_lock(&me->channel[cid].rpmsg_mutex);

	VERIFY(err, NULL != me->channel[cid].rpdev);

	if (err) {