diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2018-03-28 15:28:07 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-03-28 15:28:07 -0700 |
| commit | c638be9b40b7e2698fcc2bda3031c3556601351f (patch) | |
| tree | 8590561b754552e1dd428ebdad049251b64a0595 /drivers/char | |
| parent | 2a5b9922bfa42c68211dc546709eb8bc70b5e9ec (diff) | |
| parent | eede053d5fdc596adfa3444c36ae44626d671a45 (diff) | |
Merge "msm: ADSPRPC: Validate rpra to avoid Null pointer dereference"
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/adsprpc.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 0864f591b242..18d98292a187 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1253,7 +1253,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) /* copy non ion buffers */ PERF(ctx->fl->profile, ctx->fl->perf.copy, rlen = copylen - metalen; - for (oix = 0; oix < inbufs + outbufs; ++oix) { + for (oix = 0; rpra && oix < inbufs + outbufs; ++oix) { int i = ctx->overps[oix]->raix; struct fastrpc_mmap *map = ctx->maps[i]; size_t mlen; @@ -1304,7 +1304,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) if (map && (map->attr & FASTRPC_ATTR_COHERENT)) continue; - if (rpra[i].buf.len && ctx->overps[oix]->mstart) { + if (rpra && rpra[i].buf.len && ctx->overps[oix]->mstart) { if (map && map->handle) msm_ion_do_cache_op(ctx->fl->apps->client, map->handle, @@ -1320,7 +1320,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) PERF_END); inh = inbufs + outbufs; - for (i = 0; i < REMOTE_SCALARS_INHANDLES(sc); i++) { + for (i = 0; rpra && i < REMOTE_SCALARS_INHANDLES(sc); i++) { rpra[inh + i].buf.pv = ptr_to_uint64(ctx->lpra[inh + i].buf.pv); rpra[inh + i].buf.len = ctx->lpra[inh + i].buf.len; rpra[inh + i].h = ctx->lpra[inh + i].h; |