Commit da1ba641 authored by Ling Xu's avatar Ling Xu Committed by Greg Kroah-Hartman
Browse files

misc: fastrpc: fix possible map leak in fastrpc_put_args 



copy_to_user() failure would cause an early return without cleaning up
the fdlist, which has been updated by the DSP. This could lead to map
leak. Fix this by redirecting to a cleanup path on failure, ensuring
that all mapped buffers are properly released before returning.

Fixes: c68cfb71 ("misc: fastrpc: Add support for context Invoke method")
Cc: stable@kernel.org
Co-developed-by: default avatarEkansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: default avatarEkansh Gupta <ekansh.gupta@oss.qualcomm.com>
Signed-off-by: default avatarLing Xu <quic_lxu5@quicinc.com>
Reviewed-by: default avatarDmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: default avatarSrinivas Kandagatla <srini@kernel.org>
Link: https://lore.kernel.org/r/20250912131236.303102-4-srini@kernel.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9031626a

drivers/misc/fastrpc.c

+7 −3
Original line number Diff line number Diff line
@@ -1085,6 +1085,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, 
	struct fastrpc_phy_page *pages;

	u64 *fdlist;

	int i, inbufs, outbufs, handles;

	int ret = 0;



	inbufs = REMOTE_SCALARS_INBUFS(ctx->sc);

	outbufs = REMOTE_SCALARS_OUTBUFS(ctx->sc);
@@ -1100,14 +1101,17 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, 
			u64 len = rpra[i].buf.len;



			if (!kernel) {

				if (copy_to_user((void __user *)dst, src, len))

					return -EFAULT;

				if (copy_to_user((void __user *)dst, src, len)) {

					ret = -EFAULT;

					goto cleanup_fdlist;

				}

			} else {

				memcpy(dst, src, len);

			}

		}

	}



cleanup_fdlist:

	/* Clean up fdlist which is updated by DSP */

	for (i = 0; i < FASTRPC_MAX_FDLIST; i++) {

		if (!fdlist[i])
@@ -1116,7 +1120,7 @@ static int fastrpc_put_args(struct fastrpc_invoke_ctx *ctx, 
			fastrpc_map_put(mmap);

	}



	return 0;

	return ret;

}



static int fastrpc_invoke_send(struct fastrpc_session_ctx *sctx,