rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

msm: adsprpc: Fix race conditions on same buffer

Browse Source 
Variable map may pointing to the same buffer on race conditions
in functions fastrpc_internal_mmap and fastrpc_internal_munmap,
use mutex to avoid race conditions on same buffer.

Bug: 72957546
Change-Id: I96ed884c44a36f574677ba3ba189dfbf2ce3751d
Acked-by: Krishnaiah Tadakamalla <ktadakam@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2018-3564
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
This commit is contained in:
Tharun Kumar Merugu
2019-08-08 16:35:42 +02:00
committed by Francescodario Cuzzocrea
parent b5e0498ee7
commit d13ee8e0d5
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/char/adsprpc.c
+8
View File
@@ -204,6 +204,7 @@ struct file_data {
struct hlist_head hlst;
uint32_t mode;
int cid;
struct mutex map_mutex;
};
struct fastrpc_device {
@@ -1153,6 +1154,8 @@ static int fastrpc_internal_munmap(struct fastrpc_apps *me,
int err = 0;
struct fastrpc_mmap *map = 0, *mapfree = 0;
struct hlist_node *pos, *n;
mutex_lock(&fdata->map_mutex);
VERIFY(err, 0 == (err = fastrpc_munmap_on_dsp(me, munmap, fdata->cid)));
if (err)
goto bail;
@@ -1172,6 +1175,7 @@ bail:
free_map(mapfree, fdata->cid);
kfree(mapfree);
}
mutex_unlock(&fdata->map_mutex);
return err;
}
@@ -1189,6 +1193,7 @@ static int fastrpc_internal_mmap(struct fastrpc_apps *me,
int num;
int err = 0;
mutex_lock(&fdata->map_mutex);
VERIFY(err, 0 != (map = kzalloc(sizeof(*map), GFP_KERNEL)));
if (err)
goto bail;
@@ -1243,6 +1248,7 @@ static int fastrpc_internal_mmap(struct fastrpc_apps *me,
kfree(map);
}
kfree(pages);
mutex_unlock(&fdata->map_mutex);
return err;
}
@@ -1305,6 +1311,7 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
free_map(map, cid);
kfree(map);
}
mutex_destroy(&fdata->map_mutex);
kfree(fdata);
kref_put_mutex(&me->channel[cid].kref, fastrpc_channel_close,
&me->smd_mutex);
@@ -1355,6 +1362,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
VERIFY(err, 0 == fastrpc_create_current_dsp_process(cid));
if (err)
goto bail;
mutex_init(&fdata->map_mutex);
filp->private_data = fdata;
bail:
if (err) {