Merge "msm: ADSPRPC: validate dma phy address after mapping"
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
index 9a0424a..de9f280 100644
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -807,13 +807,24 @@
goto bail;
}
map->phys = sg_dma_address(map->table->sgl);
+
if (sess->smmu.cb) {
map->phys += ((uint64_t)sess->smmu.cb << 32);
map->size = sg_dma_len(map->table->sgl);
} else {
map->size = buf_page_size(len);
}
+
vmid = fl->apps->channel[fl->cid].vmid;
+ if (!sess->smmu.enabled && !vmid) {
+ VERIFY(err, map->phys >= me->range.addr &&
+ map->phys + map->size <=
+ me->range.addr + me->range.size);
+ if (err) {
+ pr_err("adsprpc: mmap fail out of range\n");
+ goto bail;
+ }
+ }
if (vmid) {
int srcVM[1] = {VMID_HLOS};
int destVM[2] = {VMID_HLOS, vmid};
@@ -3414,6 +3425,8 @@
srcVM, 1, destVM, destVMperm, 4));
if (err)
goto bail;
+ me->range.addr = range.addr;
+ me->range.size = range.size;
}
return 0;
}