From: Ekansh Gupta Date: Fri, 13 Oct 2023 12:20:04 +0000 (+0100) Subject: misc: fastrpc: Reset metadata buffer to avoid incorrect free X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=1c29d80134ac116e0196c7bad58a2121381b679c;p=linux.git misc: fastrpc: Reset metadata buffer to avoid incorrect free Metadata buffer is allocated during get_args for any remote call. This buffer carries buffers, fdlists and other payload information for the call. If the buffer is not reset, put_args might find some garbage FDs in the fdlist which might have an existing mapping in the list. This could result in improper freeing of FD map when DSP might still be using the buffer. Added change to reset the metadata buffer after allocation. Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation") Cc: stable Signed-off-by: Ekansh Gupta Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20231013122007.174464-2-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index a66b7c111cd51..fb921975b56d5 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -958,6 +958,7 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx) if (err) return err; + memset(ctx->buf->virt, 0, pkt_size); rpra = ctx->buf->virt; list = fastrpc_invoke_buf_start(rpra, ctx->nscalars); pages = fastrpc_phy_page_start(list, ctx->nscalars);