anierin/msm-5.15
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: adsprpc: Handle UAF in process shell memory

Browse Source 
To avoid UAF or double free of memory
add flag to know the memory is mapped
in process initialization. It skips
unmap if it is fastrpc shell memory.

Change-Id: Ifa621dee171b3d1f98b82302c847f4d767f3e736
Signed-off-by: Swathi K <kataka@codeaurora.org>
This commit is contained in:
Swathi K
2021-09-14 00:30:39 +05:30
committed by Gerrit - the friendly Code Review server
parent f5a64f3b10
commit de480f2d42
1 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/char/adsprpc.c
View File

@@ -595,6 +595,8 @@ struct fastrpc_mmap {
uintptr_t attr;
struct timespec64 map_start_time;
struct timespec64 map_end_time;
/* Mapping for fastrpc shell */
bool is_filemap;
};
enum fastrpc_perfkeys {
@@ -1274,7 +1276,9 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
hlist_for_each_entry_safe(map, n, &me->maps, hn) {
if ((fd < 0 || map->fd == fd) && map->raddr == va &&
map->raddr + map->len == va + len &&
map->refs == 1) {
map->refs == 1 &&
/* Skip unmap if it is fastrpc shell memory */
!map->is_filemap) {
match = map;
hlist_del_init(&map->hn);
break;
@@ -1288,7 +1292,9 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
if ((fd < 0 || map->fd == fd) && map->raddr == va &&
map->raddr + map->len == va + len &&
map->refs == 1) {
map->refs == 1 &&
/* Skip unmap if it is fastrpc shell memory */
!map->is_filemap) {
match = map;
hlist_del_init(&map->hn);
break;
@@ -1466,6 +1472,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, struct dma_buf *
map->attr = attr;
map->buf = buf;
map->frpc_md_index = -1;
map->is_filemap = false;
ktime_get_real_ts64(&map->map_start_time);
if (mflags == ADSP_MMAP_HEAP_ADDR ||
mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
@@ -3918,6 +3925,8 @@ static int fastrpc_init_create_dynamic_process(struct fastrpc_file *fl,
mutex_lock(&fl->map_mutex);
err = fastrpc_mmap_create(fl, init->filefd, NULL, 0,
init->file, init->filelen, mflags, &file);
if (file)
file->is_filemap = true;
mutex_unlock(&fl->map_mutex);
if (err)
goto bail;