瀏覽代碼

msm: adsprpc: To avoid null pointer dereference

To log error for fastrpc_mmap_remove_ssr and
compat_fastrpc_get_dsp_info for avoiding null pointer
dereferences leading to kw issues.

Change-Id: I0f759ce5d9c3100a5cff3e61ad1499f6eb1b55dd
Signed-off-by: Ansa Ahmed <[email protected]>
Vamsi Krishna Gattupalli 2 年之前
父節點
當前提交
bfd12fbf25
共有 2 個文件被更改,包括 9 次插入3 次删除
  1. 3 2
      dsp/adsprpc.c
  2. 6 1
      dsp/adsprpc_compat.c

+ 3 - 2
dsp/adsprpc.c

@@ -4713,7 +4713,7 @@ static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl, int locked)
 		match = NULL;
 		spin_lock_irqsave(&me->hlock, irq_flags);
 		hlist_for_each_entry_safe(map, n, &me->maps, hn) {
-			if (map->servloc_name &&
+			if (map->servloc_name && fl &&
 				fl->servloc_name && !strcmp(map->servloc_name, fl->servloc_name)) {
 				match = map;
 				if (map->is_persistent && map->in_use) {
@@ -8287,8 +8287,9 @@ static int __init fastrpc_device_init(void)
 			VERIFY(err, NULL != (buf = kzalloc(sizeof(*buf), GFP_KERNEL)));
 			if (err) {
 				err = -ENOMEM;
-				ADSPRPC_WARN("%s: CMA alloc failed  err 0x%x\n",
+				ADSPRPC_ERR("%s: CMA alloc failed  err 0x%x\n",
 							__func__, err);
+				goto device_create_bail;
 			}
 			INIT_HLIST_NODE(&buf->hn);
 			buf->virt = region_vaddr;

+ 6 - 1
dsp/adsprpc_compat.c

@@ -772,11 +772,16 @@ static int compat_fastrpc_get_dsp_info(struct fastrpc_file *fl,
 	struct fastrpc_ioctl_capability *info = NULL;
 	compat_uint_t u;
 	int err = 0;
+	size_t info_size = 0;
 
 	info32 = compat_ptr(arg);
 	VERIFY(err, NULL != (info = kmalloc(
 				sizeof(*info), GFP_KERNEL)));
-
+	info_size = sizeof(*info);
+	if (err) {
+		ADSPRPC_ERR("allocation failed for size 0x%zx\n", info_size);
+		return err;
+	}
 	err = get_user(u, &info32->domain);
 	if (err)
 		return err;