Skip to content

Commit f9a470d

Browse files
Srinivas-Kandagatlagregkh
authored andcommitted
misc: fastrpc: Add missing lock before accessing find_vma()
fastrpc driver is using find_vma() without any protection, as a result we see below warning due to recent patch 5b78ed2 ("mm/pagemap: add mmap_assert_locked() annotations to find_vma*()") which added mmap_assert_locked() in find_vma() function. This bug went un-noticed in previous versions. Fix this issue by adding required protection while calling find_vma(). CPU: 0 PID: 209746 Comm: benchmark_model Not tainted 5.15.0-rc2-00445-ge14fe2bf817a-dirty #969 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : find_vma+0x64/0xd0 lr : find_vma+0x60/0xd0 sp : ffff8000158ebc40 ... Call trace: find_vma+0x64/0xd0 fastrpc_internal_invoke+0x570/0xda8 fastrpc_device_ioctl+0x3e0/0x928 __arm64_sys_ioctl+0xac/0xf0 invoke_syscall+0x44/0x100 el0_svc_common.constprop.3+0x70/0xf8 do_el0_svc+0x24/0x88 el0_svc+0x3c/0x138 el0t_64_sync_handler+0x90/0xb8 el0t_64_sync+0x180/0x184 Fixes: 80f3afd ("misc: fastrpc: consider address offset before sending to DSP") Cc: [email protected] Signed-off-by: Srinivas Kandagatla <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 4264104 commit f9a470d

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

drivers/misc/fastrpc.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -814,10 +814,12 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx)
814814
rpra[i].pv = (u64) ctx->args[i].ptr;
815815
pages[i].addr = ctx->maps[i]->phys;
816816

817+
mmap_read_lock(current->mm);
817818
vma = find_vma(current->mm, ctx->args[i].ptr);
818819
if (vma)
819820
pages[i].addr += ctx->args[i].ptr -
820821
vma->vm_start;
822+
mmap_read_unlock(current->mm);
821823

822824
pg_start = (ctx->args[i].ptr & PAGE_MASK) >> PAGE_SHIFT;
823825
pg_end = ((ctx->args[i].ptr + len - 1) & PAGE_MASK) >>

0 commit comments

Comments
 (0)