mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-17 02:02:53 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
Currently, the DSP updates header buffers with unused DMA handle fds.
In the put_args section, if any DMA handle FDs are present in the
header buffer, the corresponding map is freed. However, since the
header buffer is exposed to users in unsigned PD, users can update
invalid FDs. If this invalid FD matches with any FD that is already
in use, it could lead to a use-after-free (UAF) vulnerability.
As a solution,add DMA handle references for DMA FDs, and the map for
the FD will be freed only when a reference is found.
Acked-by: Om Deore <quic_odeore@quicinc.com>
Change-Id: I19ae21230bf11fe89858b10c9069a5daccabc392
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
(cherry picked from commit
|
||
| .. | ||
| agp | ||
| hw_random | ||
| ipmi | ||
| mwave | ||
| pcmcia | ||
| tpm | ||
| virtio_eavb | ||
| xilinx_hwicap | ||
| xillybus | ||
| adi.c | ||
| adsprpc.c | ||
| adsprpc_compat.c | ||
| adsprpc_compat.h | ||
| adsprpc_shared.h | ||
| apm-emulation.c | ||
| applicom.c | ||
| applicom.h | ||
| bsr.c | ||
| ds1620.c | ||
| dsp56k.c | ||
| dtlk.c | ||
| efirtc.c | ||
| fastcvpd.c | ||
| hangcheck-timer.c | ||
| hpet.c | ||
| Kconfig | ||
| lp.c | ||
| Makefile | ||
| mem.c | ||
| misc.c | ||
| msm_smd_pkt.c | ||
| mspec.c | ||
| nsc_gpio.c | ||
| nvram.c | ||
| nwbutton.c | ||
| nwbutton.h | ||
| nwflash.c | ||
| pc8736x_gpio.c | ||
| powernv-op-panel.c | ||
| ppdev.c | ||
| ps3flash.c | ||
| random.c | ||
| raw.c | ||
| rdbg.c | ||
| rtc.c | ||
| scx200_gpio.c | ||
| sonypi.c | ||
| tb0219.c | ||
| tlclk.c | ||
| toshiba.c | ||
| ttyprintk.c | ||
| uv_mmtimer.c | ||
| virtio_console.c | ||
| virtio_fastrpc.c | ||