A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 12:25:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "msm: adsprpc: Handle UAF in process shell memory"

Browse source
This commit is contained in:
qctecmdr 2021-12-03 04:17:07 -08:00 • committed by Gerrit - the friendly Code Review server
commit b1d4c68617
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/char/adsprpc.c
View file

@ -573,6 +573,7 @@ struct fastrpc_mmap {
bool in_use; /* Indicates if persistent map is in use*/
struct timespec64 map_start_time;
struct timespec64 map_end_time;
bool is_filemap; /*flag to indicate map used in process init*/
};
enum fastrpc_perfkeys {
@ -1199,9 +1200,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
spin_lock(&me->hlock);
hlist_for_each_entry_safe(map, n, &me->maps, hn) {
if ((fd < 0 || map->fd == fd) && map->raddr == va &&
if (map->refs == 1 && map->raddr == va &&
map->raddr + map->len == va + len &&
map->refs == 1 && !map->is_persistent) {
/*Remove map if not used in process initialization*/
!map->is_filemap) {
match = map;
hlist_del_init(&map->hn);
break;
@ -1213,9 +1215,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
return 0;
}
hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
if ((fd < 0 || map->fd == fd) && map->raddr == va &&
if (map->refs == 1 && map->raddr == va &&
map->raddr + map->len == va + len &&
map->refs == 1) {
/*Remove map if not used in process initialization*/
!map->is_filemap) {
match = map;
hlist_del_init(&map->hn);
break;
@ -1399,6 +1402,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
map->fd = fd;
map->attr = attr;
map->frpc_md_index = -1;
map->is_filemap = false;
ktime_get_real_ts64(&map->map_start_time);
if (mflags == ADSP_MMAP_HEAP_ADDR ||
mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
@ -3683,6 +3687,8 @@ static int fastrpc_init_create_dynamic_process(struct fastrpc_file *fl,
mutex_lock(&fl->map_mutex);
err = fastrpc_mmap_create(fl, init->filefd, 0,
init->file, init->filelen, mflags, &file);
if (file)
file->is_filemap = true;
mutex_unlock(&fl->map_mutex);
if (err)
goto bail;
@ -3904,6 +3910,8 @@ static int fastrpc_init_create_static_process(struct fastrpc_file *fl,
mutex_lock(&fl->map_mutex);
err = fastrpc_mmap_create(fl, -1, 0, init->mem,
init->memlen, ADSP_MMAP_REMOTE_HEAP_ADDR, &mem);
if (mem)
mem->is_filemap = true;
mutex_unlock(&fl->map_mutex);
if (err)
goto bail;