]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
misc: fastrpc: Fix fastrpc_map_lookup operation
authorLing Xu <quic_lxu5@quicinc.com>
Fri, 12 Sep 2025 13:12:34 +0000 (14:12 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 15 Oct 2025 09:56:40 +0000 (11:56 +0200)
commitec5cb80503bbfee67573699fe52fcf456fd57678
treea97475cbef0982718f0379c22e9fc8861970be57
parentbc8b56317ff83ef4bba89bda356b93978604694f
misc: fastrpc: Fix fastrpc_map_lookup operation

commit 9031626ade38b092b72638dfe0c6ffce8d8acd43 upstream.

Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Srinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-3-srini@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/misc/fastrpc.c