R0dn3yS/android_kernel_xiaomi_sm7250
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

msm: adsprpc: Fix compat ioctl invoke failure

Browse Source 
Passing garbage address to get_user resulting badparam
error for 32 bit application use cases. Resolve address
inv32 struct pointer to fix.

Change-Id: I7b435a1071da84fac6ab91d628066efc68e22a96
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
This commit is contained in:
Vamsi Krishna Gattupalli 2022-05-16 11:48:56 +05:30
parent 7d6b043520
commit 2930998fdf
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/char/adsprpc_compat.c
View File

@ -156,7 +156,7 @@ struct compat_fastrpc_ioctl_dsp_capabilities {
static int compat_get_fastrpc_ioctl_invoke(
struct compat_fastrpc_ioctl_invoke_crc __user *inv32,
struct fastrpc_ioctl_invoke_crc __user **inva,
unsigned int cmd, unsigned int sc)
unsigned int cmd, compat_uint_t sc)
{
compat_uint_t u;
compat_size_t s;
@ -520,14 +520,14 @@ long compat_fastrpc_device_ioctl(struct file *filp, unsigned int cmd,
case COMPAT_FASTRPC_IOCTL_INVOKE_ATTRS:
case COMPAT_FASTRPC_IOCTL_INVOKE_CRC:
{
struct compat_fastrpc_ioctl_invoke_crc __user *inv32;
struct fastrpc_ioctl_invoke_crc __user *inv;
struct compat_fastrpc_ioctl_invoke_crc __user *inv32 = NULL;
struct fastrpc_ioctl_invoke_crc __user *inv = NULL;
inv32 = compat_ptr(arg);
err = get_user(sc, &inv32->inv.sc);
if (err)
return err;
inv32 = compat_ptr(arg);
VERIFY(err, 0 == compat_get_fastrpc_ioctl_invoke(inv32,
&inv, cmd, sc));
if (err)