diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index e1b1784860ab..a2039db7dd1b 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -909,6 +909,7 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd, static int fastrpc_alloc_cma_memory(dma_addr_t *region_phys, void **vaddr, size_t size, unsigned long dma_attr) { + int err = 0; struct fastrpc_apps *me = &gfa; if (me->dev == NULL) { @@ -916,6 +917,13 @@ static int fastrpc_alloc_cma_memory(dma_addr_t *region_phys, void **vaddr, "failed to allocate CMA memory, device adsprpc-mem is not initialized\n"); return -ENODEV; } + VERIFY(err, size > 0 && size < me->max_size_limit); + if (err) { + err = -EFAULT; + pr_err("adsprpc: %s: invalid allocation size 0x%zx\n", + __func__, size); + return err; + } *vaddr = dma_alloc_attrs(me->dev, size, region_phys, GFP_KERNEL, dma_attr); if (IS_ERR_OR_NULL(*vaddr)) {