From a6018f94488d4f33f06d93fc7358f7b2b1eb85c3 Mon Sep 17 00:00:00 2001 From: Edgar Flores Date: Thu, 22 Aug 2019 18:12:10 -0700 Subject: [PATCH] msm: ADSPRPC: Fix buffer length for capability API Buffer size was being set incorrectly. Buffer length for dsp attributes was being set to 4 times its actual buffer size. This was causing stack-out-of-bounds when trying to copy back the buffer on function put_args. Fix is to set buffer length to the correct buffer size of dsp attributes. Change-Id: I755034ca503d58443fa6f14bf03c18d448b290b4 Signed-off-by: Edgar Flores --- drivers/char/adsprpc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 948b39db9307..7381354733f9 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -2375,10 +2375,11 @@ static int fastrpc_kstat(const char *filename, struct kstat *stat) } static int fastrpc_get_info_from_dsp(struct fastrpc_file *fl, - uint32_t *dsp_attr, uint32_t dsp_attr_size, + uint32_t *dsp_attr_buf, + uint32_t dsp_attr_buf_len, uint32_t domain) { - int err = 0, dsp_cap_buff_size, dsp_support = 0; + int err = 0, dsp_support = 0; struct fastrpc_ioctl_invoke_crc ioctl; remote_arg_t ra[2]; struct kstat sb; @@ -2404,7 +2405,7 @@ static int fastrpc_get_info_from_dsp(struct fastrpc_file *fl, dsp_support = 0; break; } - dsp_attr[0] = dsp_support; + dsp_attr_buf[0] = dsp_support; if (dsp_support == 0) goto bail; @@ -2413,11 +2414,10 @@ static int fastrpc_get_info_from_dsp(struct fastrpc_file *fl, if (err) goto bail; - dsp_cap_buff_size = dsp_attr_size - sizeof(uint32_t); - ra[0].buf.pv = (void *)&dsp_cap_buff_size; - ra[0].buf.len = sizeof(dsp_cap_buff_size); - ra[1].buf.pv = (void *)(&dsp_attr[1]); - ra[1].buf.len = dsp_cap_buff_size * sizeof(uint32_t); + ra[0].buf.pv = (void *)&dsp_attr_buf_len; + ra[0].buf.len = sizeof(dsp_attr_buf_len); + ra[1].buf.pv = (void *)(&dsp_attr_buf[1]); + ra[1].buf.len = dsp_attr_buf_len * sizeof(uint32_t); ioctl.inv.handle = FASTRPC_STATIC_HANDLE_DSP_UTILITIES; ioctl.inv.sc = REMOTE_SCALARS_MAKE(0, 1, 1); ioctl.inv.pra = ra; @@ -2449,7 +2449,7 @@ static int fastrpc_get_info_from_kernel( * and cache on kernel */ err = fastrpc_get_info_from_dsp(fl, dsp_cap->dsp_attributes, - sizeof(dsp_cap->dsp_attributes), + FASTRPC_MAX_DSP_ATTRIBUTES - 1, domain); if (err) goto bail;