A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 12:25:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: adsprpc : Fix use after free in fastrpc_internal_mem_unmap

Browse source 
Thread 1 can make a to call fastrpc_mmap_create under internal mem map
and release fl->map_mutex. Thread 2 can make call to internal mem unmap,
acquire fl->map_mutex and get same map though fastrpc_mmap_remove.
Thread 1 fail in fastrpc_mem_map_to_dsp jumps to bail and do map free.
Thread 2 still holds same map which can lead use after free. Serialize
fastrpc internal mem map and unmap.

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2023-43514
CRs-Fixed: 3613254
Bug: 303101664

Change-Id: I54a3602914b43fc67635c0de193bd21aa13daaa3
Signed-off-by: DEEPAK SANNAPAREDDY <quic_sdeeredd@quicinc.com>
Signed-off-by: Ashutosh Verma <ashverma@motorola.com>
Reviewed-on: https://gerrit.mot.com/2832044
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Chakradhar Gajjala <gajjalac@motorola.com>
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
This commit is contained in:
DEEPAK SANNAPAREDDY 2023-10-04 14:53:03 +05:30 • committed by Xiaojun Ji
commit 87a7aa0e83
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/char/adsprpc.c
View file

@ -4959,6 +4959,7 @@ static int fastrpc_internal_mem_map(struct fastrpc_file *fl,
int err = 0;
struct fastrpc_mmap *map = NULL;
mutex_lock(&fl->internal_map_mutex);
VERIFY(err, fl->dsp_proc_init == 1);
if (err) {
pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n",
@ -4997,6 +4998,7 @@ bail:
mutex_unlock(&fl->map_mutex);
}
}
mutex_unlock(&fl->internal_map_mutex);
return err;
}
@ -5006,6 +5008,7 @@ static int fastrpc_internal_mem_unmap(struct fastrpc_file *fl,
int err = 0;
struct fastrpc_mmap *map = NULL;
mutex_lock(&fl->internal_map_mutex);
VERIFY(err, fl->dsp_proc_init == 1);
if (err) {
pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n",
@ -5051,6 +5054,7 @@ bail:
mutex_unlock(&fl->map_mutex);
}
}
mutex_unlock(&fl->internal_map_mutex);
return err;
}