android/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: adsprpc: out of bound access for glist_session_ctrl

Browse Source 
Check proper index before access glist_session_ctrl
to fix out of bound access.

Change-Id: Id942b0add1bcc99f0c2f8b22ce631a11685ab340
Signed-off-by: nishant chaubey <quic_chaubey@quicinc.com>
This commit is contained in:
nishant chaubey 2023-07-20 12:11:48 +05:30
parent ac57e6d939
commit 9e2564e979
1 changed files with 25 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
dsp/adsprpc_socket.c
View File

@ -83,7 +83,7 @@ struct remote_domain_configuration {
* glist_session_ctrl
* Static list containing socket session information for all remote domains.
*/
static struct frpc_transport_session_control *glist_session_ctrl[MAX_DOMAIN_ID][MAX_REMOTE_ID];
static struct frpc_transport_session_control *glist_session_ctrl[NUM_CHANNELS][MAX_REMOTE_ID];
static const struct remote_domain_configuration configurations[] = {
@ -555,6 +555,16 @@ int fastrpc_transport_init(void)
}
cid = configurations[ii].channel_id;
remote_domain = configurations[ii].remote_domain;
VERIFY(err, remote_domain < MAX_REMOTE_ID);
if (err) {
err = -ECHRNG;
goto bail;
}
VERIFY(err, VALID_FASTRPC_CID(cid));
if (err) {
err = -ECHRNG;
goto bail;
}
session_control->remote_server_online = false;
frpc_socket = &session_control->frpc_socket;
@ -610,13 +620,23 @@ bail:
*/
void fastrpc_transport_deinit(void)
{
int ii = 0, cid = -1, remote_domain = -1;
int ii = 0, cid = -1, remote_domain = -1, err = 0;
struct fastrpc_socket *frpc_socket = NULL;
struct frpc_transport_session_control *session_control = NULL;
for (ii = 0; ii < ARRAY_SIZE(configurations); ii++) {
cid = configurations[ii].channel_id;
remote_domain = configurations[ii].remote_domain;
VERIFY(err, remote_domain < MAX_REMOTE_ID);
if (err) {
err = -ECHRNG;
goto bail;
}
VERIFY(err, VALID_FASTRPC_CID(cid));
if (err) {
err = -ECHRNG;
goto bail;
}
session_control = glist_session_ctrl[cid][remote_domain];
if (!session_control)
@ -637,4 +657,7 @@ void fastrpc_transport_deinit(void)
kfree(session_control);
glist_session_ctrl[cid][remote_domain] = NULL;
}
bail:
if (err)
ADSPRPC_ERR("fastrpc_socket_deinit failed with err %d\n", err);
}