A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

BACKPORT: dsp-kernel: Validate page range with map range before passing to DSP

Browse source 
In case of unaligned start address and NOVA flag set, range validation
is by-passed. The page size calculated using unaligned address passed by
user is aligned to nearest boundary internally which returns page size
4KB more. In order to avoid out of bounds issue, check page range is within
map range.

Change-Id: Ie2de944206eee0730c8ba081f05b7d7cccc72276
Signed-off-by: Om Deore <quic_odeore@quicinc.com>
This commit is contained in:
Om Deore 2025-07-15 13:30:42 +05:30 • committed by Michael Bestas
commit 28e935c7d0
No known key found for this signature in database
GPG key ID: CC95044519BE6669
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/misc/fastrpc.c
View file

@ -813,6 +813,22 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx)
PAGE_SHIFT;
pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE;
/*
* Check for page range overflow and validate page
* range is not greater than map buffer range.
* This prevents potential buffer overflow
* and memory corruption that could be exploited.
*/
if (pages[i].addr > (ULLONG_MAX - pages[i].size) ||
(pages[i].addr + pages[i].size) >
(ctx->maps[i]->phys + ctx->maps[i]->size)) {
err = -EFAULT;
dev_err(dev,
"Invalid buffer addr 0x%llx len 0x%llx IPA 0x%llx size 0x%llx fd %d\n",
ctx->args[i].ptr, len, ctx->maps[i]->phys,
ctx->maps[i]->size, ctx->maps[i]->fd);
goto bail;
}
} else {
if (ctx->olaps[oix].offset == 0) {