malhuda/msm-4.14
1
0
Fork 0
mirror of https://github.com/rd-stuffs/msm-4.14.git synced 2025-02-20 11:45:48 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

smcinvoke : file private data validation, which is sent by userspace

Browse Source 
a validation added to check  whether retrieved struct smcinvoke_file_data
inside the function get_server_id belongs to g_smcinvoke_fops or not.

Change-Id: If949889a764775200650a8d0b744359c0611b576
Signed-off-by: Pavan Bobba <quic_pav@quicinc.com>
This commit is contained in:
Pavan Bobba 2022-04-07 18:28:46 +05:30 committed by Gerrit - the friendly Code Review server
parent 28ca2b9d69
commit 2fe4097289
1 changed files with 3 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/soc/qcom/smcinvoke.c
View File

@ -2,7 +2,7 @@
* SMC Invoke driver * SMC Invoke driver
* *
* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
* * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and * it under the terms of the GNU General Public License version 2 and
* only version 2 as published by the Free Software Foundation. * only version 2 as published by the Free Software Foundation.
@ -595,15 +595,13 @@ static uint16_t get_server_id(int cb_server_fd)
struct smcinvoke_file_data *svr_cxt = NULL; struct smcinvoke_file_data *svr_cxt = NULL;
struct file *tmp_filp = fget(cb_server_fd); struct file *tmp_filp = fget(cb_server_fd);
if (!tmp_filp) if (!tmp_filp || !FILE_IS_REMOTE_OBJ(tmp_filp))
return server_id; return server_id;
svr_cxt = tmp_filp->private_data; svr_cxt = tmp_filp->private_data;
if (svr_cxt && svr_cxt->context_type == SMCINVOKE_OBJ_TYPE_SERVER) if (svr_cxt && svr_cxt->context_type == SMCINVOKE_OBJ_TYPE_SERVER)
server_id = svr_cxt->server_id; server_id = svr_cxt->server_id;
fput(tmp_filp);
if (tmp_filp)
fput(tmp_filp);
return server_id; return server_id;
} }