linux-kernel - [PATCH v3 2/4] misc: fastrpc: Fix fastrpc_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250807100420.1163967-3-quic_lxu5@quicinc.com>
Date: Thu, 7 Aug 2025 15:34:18 +0530
From: Ling Xu <quic_lxu5@...cinc.com>
To: <srini@...nel.org>, <amahesh@....qualcomm.com>, <arnd@...db.de>,
        <gregkh@...uxfoundation.org>, <sumit.semwal@...aro.org>,
        <christian.koenig@....com>, <thierry.escande@...aro.org>,
        <quic_vgattupa@...cinc.com>
CC: <quic_kuiw@...cinc.com>, <ekansh.gupta@....qualcomm.com>,
        <dri-devel@...ts.freedesktop.org>, <linux-arm-msm@...r.kernel.org>,
        <linux-media@...r.kernel.org>, <linaro-mm-sig@...ts.linaro.org>,
        <linux-kernel@...r.kernel.org>, Ling Xu <quic_lxu5@...cinc.com>,
        <stable@...nel.org>
Subject: [PATCH v3 2/4] misc: fastrpc: Fix fastrpc_map_lookup operation

Fastrpc driver creates maps for user allocated fd buffers. Before
creating a new map, the map list is checked for any already existing
maps using map fd. Checking with just map fd is not sufficient as the
user can pass offsetted buffer with less size when the map is created
and then a larger size the next time which could result in memory
issues. Check for dma_buf object also when looking up for the map.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@...nel.org
Co-developed-by: Ekansh Gupta <ekansh.gupta@....qualcomm.com>
Signed-off-by: Ekansh Gupta <ekansh.gupta@....qualcomm.com>
Signed-off-by: Ling Xu <quic_lxu5@...cinc.com>
---
 drivers/misc/fastrpc.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 52571916acd4..1815b1e0c607 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -367,11 +367,16 @@ static int fastrpc_map_lookup(struct fastrpc_user *fl, int fd,
 {
 	struct fastrpc_session_ctx *sess = fl->sctx;
 	struct fastrpc_map *map = NULL;
+	struct dma_buf *buf;
 	int ret = -ENOENT;
 
+	buf = dma_buf_get(fd);
+	if (IS_ERR(buf))
+		return PTR_ERR(buf);
+
 	spin_lock(&fl->lock);
 	list_for_each_entry(map, &fl->maps, node) {
-		if (map->fd != fd)
+		if (map->fd != fd || map->buf != buf)
 			continue;
 
 		if (take_ref) {
-- 
2.34.1