A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-29 19:21:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

securemsm-kernel: Fix multiple listener registration on same fd

Browse source 
Currently, multiple listeners can register on same fd which
could lead to potential vulnerabilities of use after free
while unregistering the listener. Add check to prevent more
than one listener registration on a fd.

Change-Id: Ia2973853943b5619bcf2047629b9c193f6a8c5cf
Signed-off-by: Pawan Rai <[email protected]>
Signed-off-by: Ravi Kumar Bokka <[email protected]>
This commit is contained in:
Ravi Kumar Bokka 2023-09-05 14:05:00 +05:30 • committed by Ravi Kuamr Bokka
commit e47d921a39
1 changed files with 16 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

17
drivers/misc/qseecom.c
View file

@ -378,7 +378,7 @@ struct qseecom_client_handle {
struct qseecom_listener_handle {
u32 id;
bool unregister_pending;
bool register_pending;
bool release_called;
};
@ -1550,6 +1550,11 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data,
struct qseecom_registered_listener_list *new_entry;
struct qseecom_registered_listener_list *ptr_svc;
if (data->listener.register_pending) {
pr_err("Already a listner registration is in process on this FD\n");
return -EINVAL;
}
ret = copy_from_user(&rcvd_lstnr, argp, sizeof(rcvd_lstnr));
if (ret) {
pr_err("copy_from_user failed\n");
@ -1559,6 +1564,13 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data,
rcvd_lstnr.sb_size))
return -EFAULT;
ptr_svc = __qseecom_find_svc(data->listener.id);
if (ptr_svc) {
pr_err("Already a listener registered on this data: lid=%d\n",
data->listener.id);
return -EINVAL;
}
ptr_svc = __qseecom_find_svc(rcvd_lstnr.listener_id);
if (ptr_svc) {
if (!ptr_svc->unregister_pending) {
@ -1602,13 +1614,16 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data,
new_entry->svc.listener_id = rcvd_lstnr.listener_id;
new_entry->sb_length = rcvd_lstnr.sb_size;
new_entry->user_virt_sb_base = rcvd_lstnr.virt_sb_base;
data->listener.register_pending = true;
if (__qseecom_set_sb_memory(new_entry, data, &rcvd_lstnr)) {
pr_err("qseecom_set_sb_memory failed for listener %d, size %d\n",
rcvd_lstnr.listener_id, rcvd_lstnr.sb_size);
__qseecom_free_tzbuf(&new_entry->sglistinfo_shm);
kzfree(new_entry);
data->listener.register_pending = false;
return -ENOMEM;
}
data->listener.register_pending = false;
init_waitqueue_head(&new_entry->rcv_req_wq);
init_waitqueue_head(&new_entry->listener_block_app_wq);