Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e631ba10 authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu Committed by Gerrit - the friendly Code Review server
Browse files

msm: adsprpc: Validate buffer pointer before flush 



Check for valid map->buf before calling flush on these buffers.

Change-Id: Ifab138d3523f4f56df97724ef418e3cc40bb925c
Acked-by: default avatarJeya R <jeyr@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 76ec68dc

drivers/char/adsprpc.c

+3 −3
Original line number Original line Diff line number Diff line
@@ -1598,7 +1598,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
			continue;

			continue;





		if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart) {

		if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart) {

			if (map && map->handle) {

			if (map && map->buf) {

				dma_buf_begin_cpu_access(map->buf,

				dma_buf_begin_cpu_access(map->buf,

					DMA_BIDIRECTIONAL);

					DMA_BIDIRECTIONAL);

				dma_buf_end_cpu_access(map->buf,

				dma_buf_end_cpu_access(map->buf,
@@ -1703,7 +1703,7 @@ static void inv_args_pre(struct smq_invoke_ctx *ctx) 
			continue;

			continue;

		if (!IS_CACHE_ALIGNED((uintptr_t)

		if (!IS_CACHE_ALIGNED((uintptr_t)

				uint64_to_ptr(rpra[i].buf.pv))) {

				uint64_to_ptr(rpra[i].buf.pv))) {

			if (map && map->handle) {

			if (map && map->buf) {

				dma_buf_begin_cpu_access(map->buf,

				dma_buf_begin_cpu_access(map->buf,

					DMA_BIDIRECTIONAL);

					DMA_BIDIRECTIONAL);

				dma_buf_end_cpu_access(map->buf,

				dma_buf_end_cpu_access(map->buf,
@@ -1717,7 +1717,7 @@ static void inv_args_pre(struct smq_invoke_ctx *ctx) 
		end = (uintptr_t)uint64_to_ptr(rpra[i].buf.pv +

		end = (uintptr_t)uint64_to_ptr(rpra[i].buf.pv +

							rpra[i].buf.len);

							rpra[i].buf.len);

		if (!IS_CACHE_ALIGNED(end)) {

		if (!IS_CACHE_ALIGNED(end)) {

			if (map && map->handle) {

			if (map && map->buf) {

				dma_buf_begin_cpu_access(map->buf,

				dma_buf_begin_cpu_access(map->buf,

					DMA_BIDIRECTIONAL);

					DMA_BIDIRECTIONAL);

				dma_buf_end_cpu_access(map->buf,

				dma_buf_end_cpu_access(map->buf,