evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: ADSPRPC: Buffer length to be copied is truncated

Browse source 
The buffer length that is being used to allocate gets truncated
due to it being assigned to wrong type causing a much smaller
buffer to be allocated than what is required for copying.

Change-Id: I30818acd42bd282837c7c7aa16d56d3b95d4dfe7
Signed-off-by: Sathish Ambley <sathishambley@codeaurora.org>
This commit is contained in:
Sathish Ambley 2016-12-13 15:27:30 -08:00 • committed by Gerrit - the friendly Code Review server
parent 2116b44bd3
commit b1cfb2c899
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/char/adsprpc.c
View file

@ -1033,6 +1033,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
/* calculate len requreed for copying */
for (oix = 0; oix < inbufs + outbufs; ++oix) {
int i = ctx->overps[oix]->raix;
uintptr_t mstart, mend;
ssize_t len = lpra[i].buf.len;
if (!len)
continue;
@ -1040,7 +1041,15 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
continue;
if (ctx->overps[oix]->offset == 0)
copylen = ALIGN(copylen, BALIGN);
copylen += ctx->overps[oix]->mend - ctx->overps[oix]->mstart;
mstart = ctx->overps[oix]->mstart;
mend = ctx->overps[oix]->mend;
VERIFY(err, (mend - mstart) <= LONG_MAX);
if (err)
goto bail;
copylen += mend - mstart;
VERIFY(err, copylen >= 0);
if (err)
goto bail;
}
ctx->used = copylen;
@ -1108,7 +1117,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
for (oix = 0; oix < inbufs + outbufs; ++oix) {
int i = ctx->overps[oix]->raix;
struct fastrpc_mmap *map = ctx->maps[i];
int mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart;
ssize_t mlen;
uint64_t buf;
ssize_t len = lpra[i].buf.len;
if (!len)
@ -1119,6 +1128,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
rlen -= ALIGN(args, BALIGN) - args;
args = ALIGN(args, BALIGN);
}
mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart;
VERIFY(err, rlen >= mlen);
if (err)
goto bail;