raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

misc: fastrpc: Fix fastrpc_map_lookup operation

Browse Source 
Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.

Fixes: c68cfb718c ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ling Xu
2025-09-12 14:12:34 +01:00
committed by Greg Kroah-Hartman
parent 8b5b456222
commit 9031626ade
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/misc/fastrpc.c
View File

@@ -367,11 +367,16 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
{ {
struct fastrpc_session_ctx *sess = fl->sctx; struct fastrpc_session_ctx *sess = fl->sctx;
struct fastrpc_map *map = NULL; struct fastrpc_map *map = NULL;
struct dma_buf *buf;
int ret = -ENOENT; int ret = -ENOENT;
buf = dma_buf_get(fd);
if (IS_ERR(buf))
return PTR_ERR(buf);
spin_lock(&fl->lock); spin_lock(&fl->lock);
list_for_each_entry(map, &fl->maps, node) { list_for_each_entry(map, &fl->maps, node) {
if (map->fd != fd) if (map->fd != fd || map->buf != buf)
continue; continue;
if (take_ref) { if (take_ref) {