From 2b6a421ff8e26f1049711ef1a1f6cf95adc87fb3 Mon Sep 17 00:00:00 2001
From: Ajit Pandey <ajitp@codeaurora.org>
Date: Thu, 28 Feb 2019 18:03:17 +0530
Subject: [PATCH] drivers: soc: qcom: Added check to avoid opening multiple
 instance

Opening of multiple instance of voice_svc user space from app will
lead to pointer deference of private data within apr callback. As
multi-instance not supported added check to deny open() from user
space if previous instance hasn't been closed.

Change-Id: Ia5ef16c69a517760fc9d45530a8a41a333fa2a21
Signed-off-by: Ajit Pandey <ajitp@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2019-10497
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
---
 arch/arm/mach-msm/qdsp6v2/voice_svc.c | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/arch/arm/mach-msm/qdsp6v2/voice_svc.c b/arch/arm/mach-msm/qdsp6v2/voice_svc.c
index e1b826737b4..1f225fe50f5 100755
--- a/arch/arm/mach-msm/qdsp6v2/voice_svc.c
+++ b/arch/arm/mach-msm/qdsp6v2/voice_svc.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2019, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -69,8 +69,9 @@ static void *dummy_q6_mvm;
 static void *dummy_q6_cvs;
 dev_t device_num;
 
+struct mutex session_lock;
 spinlock_t voicesvc_lock;
-static bool is_released;
+static bool is_released = 1;
 static int voice_svc_dummy_reg(void);
 static int voice_svc_dummy_dereg(void);
 
@@ -565,13 +566,22 @@ static int voice_svc_dummy_dereg(void)
 static int voice_svc_open(struct inode *inode, struct file *file)
 {
 	struct voice_svc_prvt *prtd = NULL;
+	int ret = 0;
+
+	mutex_lock(&session_lock);
+	if (is_released == 0) {
+		pr_err("%s: Access denied to device\n", __func__);
+		ret = -EBUSY;
+		goto done;
+	}
 
 	prtd = kmalloc(sizeof(struct voice_svc_prvt), GFP_KERNEL);
 
 	if (prtd == NULL) {
 		pr_err("%s: kmalloc failed", __func__);
 
-		return -ENOMEM;
+		ret = -ENOMEM;
+		goto done;
 	}
 
 	memset(prtd, 0, sizeof(struct voice_svc_prvt));
@@ -596,7 +606,9 @@ static int voice_svc_open(struct inode *inode, struct file *file)
 		voice_svc_dummy_reg();
 		reg_dummy_sess = 1;
 	}
-	return 0;
+done:
+	mutex_unlock(&session_lock);
+	return ret;
 }
 
 static int voice_svc_release(struct inode *inode, struct file *file)
@@ -679,6 +691,7 @@ static int voice_svc_probe(struct platform_device *pdev)
 	}
 	pr_debug("%s: Device created\n", __func__);
 	spin_lock_init(&voicesvc_lock);
+	mutex_init(&session_lock);
 	goto done;
 
 add_err:
@@ -698,6 +711,7 @@ static int voice_svc_remove(struct platform_device *pdev)
 	kfree(voice_svc_dev->cdev);
 	device_destroy(voice_svc_class, device_num);
 	class_destroy(voice_svc_class);
+	mutex_destroy(&session_lock);
 	unregister_chrdev_region(0, MINOR_NUMBER);
 	kfree(voice_svc_dev);