From 9d43774cd24dac7e8d7e354885c3a7d9145c6b91 Mon Sep 17 00:00:00 2001 From: Himateja Reddy Date: Tue, 28 Apr 2020 16:18:05 -0700 Subject: [PATCH] msm: adsprpc: allow only unsigned offload for untrusted apps Restrict untrusted third-party applications to only unsigned PD offload on the remote subsystem. This is done by comparing PID at the time of process create with the one stored during device open as the fastrpc device will be opened by DSP HAL service on behalf of third-party applications. Change-Id: Ibaead21a429e6bffe8f0808eebf93bf71d1db7ab Acked-by: Thyagarajan Venkatanarayanan Signed-off-by: Himateja Reddy --- drivers/char/adsprpc.c | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index f41acc09c08d..f62d7d7ac707 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -179,8 +179,11 @@ #define INIT_MEMLEN_MAX (8*1024*1024) #define MAX_CACHE_BUF_SIZE (8*1024*1024) -/* Position of privilege bit in remote process attribute */ -#define FASTRPC_MODE_PRIVILEGED (1 << 6) +/* Fastrpc remote process attributes */ +enum fastrpc_proc_attr { + FASTRPC_MODE_UNSIGNED_MODULE = (1 << 3), + FASTRPC_MODE_PRIVILEGED = (1 << 6), +}; #define PERF_END (void)0 @@ -492,7 +495,8 @@ struct fastrpc_file { uint32_t mode; uint32_t profile; int sessionid; - int tgid; + int tgid_open; /* Process ID during device open */ + int tgid; /* Process ID that uses device for RPC calls */ int cid; uint64_t ssrcount; int pd; @@ -2810,6 +2814,22 @@ static int fastrpc_init_create_dynamic_process(struct fastrpc_file *fl, } inbuf.pageslen = 1; + /* + * Third-party apps don't have permission to open the fastrpc device, so + * it is opened on their behalf by a trusted process. Such untrusted + * apps are not allowed to offload to signedPD on DSP. This is detected + * by comparing current PID with the one stored during device open. + */ + if (fl->tgid != fl->tgid_open) { + VERIFY(err, uproc->attrs & FASTRPC_MODE_UNSIGNED_MODULE); + if (err) { + err = -EINVAL; + pr_err("Error: adsprpc: %s: %s: untrusted app trying to offload to signed remote process\n", + __func__, current->comm); + goto bail; + } + } + /* Disregard any privilege bits from userspace */ uproc->attrs &= (~FASTRPC_MODE_PRIVILEGED); @@ -4388,6 +4408,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp) init_waitqueue_head(&fl->async_wait_queue); INIT_HLIST_NODE(&fl->hn); fl->sessionid = 0; + fl->tgid_open = current->tgid; fl->apps = me; fl->mode = FASTRPC_MODE_SERIAL; fl->cid = -1;