A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 20:33:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

msm: adsprpc: Handle UAF in process shell memory

Browse source 
Added flag to indicate memory used
in process initialization. And, this memory
would not removed in internal unmap to avoid
UAF or double free.

Change-Id: Ie470fe58ac334421d186feb41fa67bd24bb5efea
Signed-off-by: prabha <prabha@codeaurora.org>
This commit is contained in:
prabha 2021-11-25 13:09:50 +05:30
commit eec9f0cfa9
1 changed files with 12 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
drivers/char/adsprpc.c
View file

@ -573,6 +573,7 @@ struct fastrpc_mmap {
bool in_use; /* Indicates if persistent map is in use*/
struct timespec64 map_start_time;
struct timespec64 map_end_time;
bool is_filemap; /*flag to indicate map used in process init*/
};
enum fastrpc_perfkeys {
@ -1199,9 +1200,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
spin_lock(&me->hlock);
hlist_for_each_entry_safe(map, n, &me->maps, hn) {
if ((fd < 0 || map->fd == fd) && map->raddr == va &&
if (map->refs == 1 && map->raddr == va &&
map->raddr + map->len == va + len &&
map->refs == 1 && !map->is_persistent) {
/*Remove map if not used in process initialization*/
!map->is_filemap) {
match = map;
hlist_del_init(&map->hn);
break;
@ -1213,9 +1215,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
return 0;
}
hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
if ((fd < 0 || map->fd == fd) && map->raddr == va &&
if (map->refs == 1 && map->raddr == va &&
map->raddr + map->len == va + len &&
map->refs == 1) {
/*Remove map if not used in process initialization*/
!map->is_filemap) {
match = map;
hlist_del_init(&map->hn);
break;
@ -1399,6 +1402,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
map->fd = fd;
map->attr = attr;
map->frpc_md_index = -1;
map->is_filemap = false;
ktime_get_real_ts64(&map->map_start_time);
if (mflags == ADSP_MMAP_HEAP_ADDR ||
mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
@ -3683,6 +3687,8 @@ static int fastrpc_init_create_dynamic_process(struct fastrpc_file *fl,
mutex_lock(&fl->map_mutex);
err = fastrpc_mmap_create(fl, init->filefd, 0,
init->file, init->filelen, mflags, &file);
if (file)
file->is_filemap = true;
mutex_unlock(&fl->map_mutex);
if (err)
goto bail;
@ -3904,6 +3910,8 @@ static int fastrpc_init_create_static_process(struct fastrpc_file *fl,
mutex_lock(&fl->map_mutex);
err = fastrpc_mmap_create(fl, -1, 0, init->mem,
init->memlen, ADSP_MMAP_REMOTE_HEAP_ADDR, &mem);
if (mem)
mem->is_filemap = true;
mutex_unlock(&fl->map_mutex);
if (err)
goto bail;