evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: ADSPRPC: Validate rpra to avoid Null pointer dereference"

Browse source
This commit is contained in:
Linux Build Service Account 2018-03-28 15:28:07 -07:00 • committed by Gerrit - the friendly Code Review server
commit c638be9b40
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
drivers/char/adsprpc.c
View file

@ -1253,7 +1253,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
/* copy non ion buffers */
PERF(ctx->fl->profile, ctx->fl->perf.copy,
rlen = copylen - metalen;
for (oix = 0; oix < inbufs + outbufs; ++oix) {
for (oix = 0; rpra && oix < inbufs + outbufs; ++oix) {
int i = ctx->overps[oix]->raix;
struct fastrpc_mmap *map = ctx->maps[i];
size_t mlen;
@ -1304,7 +1304,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
if (map && (map->attr & FASTRPC_ATTR_COHERENT))
continue;
if (rpra[i].buf.len && ctx->overps[oix]->mstart) {
if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart) {
if (map && map->handle)
msm_ion_do_cache_op(ctx->fl->apps->client,
map->handle,
@ -1320,7 +1320,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
PERF_END);
inh = inbufs + outbufs;
for (i = 0; i < REMOTE_SCALARS_INHANDLES(sc); i++) {
for (i = 0; rpra && i < REMOTE_SCALARS_INHANDLES(sc); i++) {
rpra[inh + i].buf.pv = ptr_to_uint64(ctx->lpra[inh + i].buf.pv);
rpra[inh + i].buf.len = ctx->lpra[inh + i].buf.len;
rpra[inh + i].h = ctx->lpra[inh + i].h;