From nobody Thu Oct 2 19:33:30 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E887B30EF90 for ; Fri, 12 Sep 2025 13:12:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757682773; cv=none; b=jl4u4mSwL/5+7zkeEzdzHiswiY6obaU+b+FcIVt1cbxudnSbg/z02lHY+OqWY144Ql5Ft8XL9vOuhBGzeZwjM3EpKyyXfXJXjjkDybD2WrMX65luCe/AL90HpnU8x7bgxcQqvNWZMUfBDMqvdOVG65f9cpBQ1AcJJ5T5CUhqhBU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1757682773; c=relaxed/simple; bh=tdwo+nYVdYg7cQqJ6RkgwgBb8l3EtRx9h1/tdvcwODk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XqVksnkv8dvvsYMxEukTnWJJT14fQ8IlTCSCxMu5HAVnqRWtqcNYTYC6bFgiDk3enCcjletRBpj76LNAp0tXZVLUAh4qPkGLSYseAUNfkDm9xrXB0AFRMVgQb2aGvuJbpY6C2nfMDZ2gqxstgummOFtDBl6bmskVGxT2YFuU9D8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IEsU7onV; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IEsU7onV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30984C4CEF1; Fri, 12 Sep 2025 13:12:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1757682771; bh=tdwo+nYVdYg7cQqJ6RkgwgBb8l3EtRx9h1/tdvcwODk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IEsU7onVCQUb1Hfd450lYShrEII9Y5vT1s1wZMLomH7yTPE15pyw/CUe1qBa9YyPD c63e6UYl95303xllOoGtcTdV66nhOGqrUMicxUw7GT6cH8Pd+yooScpv7wBXBAN8l+ PytEjrNcBPYMBONlk0IZulW9Xk8dAUiBiDZdwZxeB1eZNjQjpfnQP+LmWvhILHn6vs aFXPffE1c0d15fK3jzre5zq/h3gcQoGc1ENal0ngLaCnt6ppXTLhelxtE7v0dCUbBO GJI96smcQ0YGJ7zIcRRuTEyESmGL+QV9cV9j++l0uCMCEPYBK2Vt4MjDmc6cvT0pGI a5JksJuDQ7QcA== From: srini@kernel.org To: gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, Ling Xu , stable@kernel.org, Ekansh Gupta , Dmitry Baryshkov , Srinivas Kandagatla Subject: [PATCH 2/4] misc: fastrpc: Fix fastrpc_map_lookup operation Date: Fri, 12 Sep 2025 14:12:34 +0100 Message-ID: <20250912131236.303102-3-srini@kernel.org> X-Mailer: git-send-email 2.50.0 In-Reply-To: <20250912131236.303102-1-srini@kernel.org> References: <20250912131236.303102-1-srini@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Ling Xu Fastrpc driver creates maps for user allocated fd buffers. Before creating a new map, the map list is checked for any already existing maps using map fd. Checking with just map fd is not sufficient as the user can pass offsetted buffer with less size when the map is created and then a larger size the next time which could result in memory issues. Check for dma_buf object also when looking up for the map. Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method") Cc: stable@kernel.org Co-developed-by: Ekansh Gupta Signed-off-by: Ekansh Gupta Signed-off-by: Ling Xu Reviewed-by: Dmitry Baryshkov Signed-off-by: Srinivas Kandagatla --- drivers/misc/fastrpc.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 52571916acd4..1815b1e0c607 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -367,11 +367,16 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl= , int fd, { struct fastrpc_session_ctx *sess =3D fl->sctx; struct fastrpc_map *map =3D NULL; + struct dma_buf *buf; int ret =3D -ENOENT; =20 + buf =3D dma_buf_get(fd); + if (IS_ERR(buf)) + return PTR_ERR(buf); + spin_lock(&fl->lock); list_for_each_entry(map, &fl->maps, node) { - if (map->fd !=3D fd) + if (map->fd !=3D fd || map->buf !=3D buf) continue; =20 if (take_ref) { --=20 2.50.0