From 46db8e981e9d54b89d5140a497954222e9e03bfe Mon Sep 17 00:00:00 2001 From: Abhinav Parihar Date: Tue, 17 Dec 2024 18:34:34 +0530 Subject: [PATCH 1/2] BACKPORT: dsp-kernel: Add attribute and flag checks during map creation A persistence map is expected to hold refs=2 during its creation. However, the Fuzzy test can create a persistence map by configuring a mismatch between attributes and flags using the KEEP MAP attribute and FD NOMAP flags. This sets the map reference count to 1. The user then calls fastrpc_internal_munmap_fd to free the map since it doesn't check flags, which can cause a use-after-free (UAF) for the file map and shared buffer. Add a check to restrict DMA handle maps with invalid attributes. Change-Id: I2f024ef99cc2a0487010504166e3af3433d5302d Acked-by: Santosh Signed-off-by: Abhinav Parihar --- drivers/char/adsprpc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index c5c3d59c7709..7ecf16753f17 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1443,6 +1443,12 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, goto bail; } } else if (mflags == FASTRPC_DMAHANDLE_NOMAP) { + if (map->attr & FASTRPC_ATTR_KEEP_MAP) { + ADSPRPC_ERR("Invalid attribute 0x%x for fd %d\n", + map->attr, fd); + err = -EINVAL; + goto bail; + } VERIFY(err, !IS_ERR_OR_NULL(map->buf = dma_buf_get(fd))); if (err) { ADSPRPC_ERR("dma_buf_get failed for fd %d ret %ld\n", From 1b4505ee95bc480d4133fe6ca36316d64ae5523b Mon Sep 17 00:00:00 2001 From: Jianmin Zhu Date: Fri, 20 Sep 2024 19:02:42 -0700 Subject: [PATCH 2/2] qcacmn: Fix OOB Read in util_gen_new_ie In util_gen_new_ie, there is a possible out-of-bound read due to a missing length check for extended IEs in the final pass over the copied subelements. Fix is to check tmp_new[1] is not zero. Change-Id: Ic393d699a208bb54ff645bd8d2424b84becf5543 CRs-Fixed: 3924648 --- .../umac/scan/dispatcher/src/wlan_scan_utils_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c index de03b1eb334c..4c1d4a9270f0 100644 --- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2167,7 +2167,7 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen, if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP || tmp_new[0] == WLAN_ELEMID_SSID || tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX || - ((tmp_new[0] == WLAN_ELEMID_EXTN_ELEM) && + ((tmp_new[0] == WLAN_ELEMID_EXTN_ELEM) && tmp_new[1] && (tmp_new[2] == WLAN_EXTN_ELEMID_NONINHERITANCE)))) { if ((pos + tmp_new[1] + MIN_IE_LEN) <= (new_ie + ielen)) {