From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B448C4332F for ; Tue, 31 Oct 2023 17:49:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376518AbjJaRtu (ORCPT ); Tue, 31 Oct 2023 13:49:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50652 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1376531AbjJaRts (ORCPT ); Tue, 31 Oct 2023 13:49:48 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93194A2 for ; Tue, 31 Oct 2023 10:49:46 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5623C433C8; Tue, 31 Oct 2023 17:49:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1698774586; bh=iOsyg6n+q7ITCbgxSl0zwfG6hk4SjuAlJ81JKdHPdDM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tIf966C0JKWcxZjo31EmZq2E4ONCXGY7v9OsE0EnsU1mKbWyA3nw2ZwoslVL/nyPc jyyLQ49LDG0nY9ou0wk6u/iNabGh7UWY/29E1xBWdZOFZJyghdxWoRrIEVvxsr8mSJ 96X1GRjszSA9/Jujzu4JbZJUZKrhapG19OwWIguo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Ekansh Gupta , Srinivas Kandagatla Subject: [PATCH 6.5 095/112] misc: fastrpc: Reset metadata buffer to avoid incorrect free Date: Tue, 31 Oct 2023 18:01:36 +0100 Message-ID: <20231031165904.288118865@linuxfoundation.org> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231031165901.318222981@linuxfoundation.org> References: <20231031165901.318222981@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org 6.5-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ekansh Gupta commit 1c29d80134ac116e0196c7bad58a2121381b679c upstream. Metadata buffer is allocated during get_args for any remote call. This buffer carries buffers, fdlists and other payload information for the call. If the buffer is not reset, put_args might find some garbage FDs in the fdlist which might have an existing mapping in the list. This could result in improper freeing of FD map when DSP might still be using the buffer. Added change to reset the metadata buffer after allocation. Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") Cc: stable Signed-off-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20231013122007.174464-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/misc/fastrpc.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -957,6 +957,7 @@ static int fastrpc_get_args(u32 kernel, if (err) return err; + memset(ctx->buf->virt, 0, pkt_size); rpra = ctx->buf->virt; list = fastrpc_invoke_buf_start(rpra, ctx->nscalars); pages = fastrpc_phy_page_start(list, ctx->nscalars);