From d13ee8e0d5870090d6ff92b94de212e59140a007 Mon Sep 17 00:00:00 2001
From: Tharun Kumar Merugu <mtharu@codeaurora.org>
Date: Tue, 2 Jan 2018 11:42:45 +0530
Subject: [PATCH] msm: adsprpc: Fix race conditions on same buffer

Variable map may pointing to the same buffer on race conditions
in functions fastrpc_internal_mmap and fastrpc_internal_munmap,
use mutex to avoid race conditions on same buffer.

Bug: 72957546
Change-Id: I96ed884c44a36f574677ba3ba189dfbf2ce3751d
Acked-by: Krishnaiah Tadakamalla <ktadakam@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2018-3564
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
---
 drivers/char/adsprpc.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
index c9c43016a71..33d22ced1d5 100644
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -204,6 +204,7 @@ struct file_data {
 	struct hlist_head hlst;
 	uint32_t mode;
 	int cid;
+	struct mutex map_mutex;
 };
 
 struct fastrpc_device {
@@ -1153,6 +1154,8 @@ static int fastrpc_internal_munmap(struct fastrpc_apps *me,
 	int err = 0;
 	struct fastrpc_mmap *map = 0, *mapfree = 0;
 	struct hlist_node *pos, *n;
+
+	mutex_lock(&fdata->map_mutex);
 	VERIFY(err, 0 == (err = fastrpc_munmap_on_dsp(me, munmap, fdata->cid)));
 	if (err)
 		goto bail;
@@ -1172,6 +1175,7 @@ bail:
 		free_map(mapfree, fdata->cid);
 		kfree(mapfree);
 	}
+	mutex_unlock(&fdata->map_mutex);
 	return err;
 }
 
@@ -1189,6 +1193,7 @@ static int fastrpc_internal_mmap(struct fastrpc_apps *me,
 	int num;
 	int err = 0;
 
+	mutex_lock(&fdata->map_mutex);
 	VERIFY(err, 0 != (map = kzalloc(sizeof(*map), GFP_KERNEL)));
 	if (err)
 		goto bail;
@@ -1243,6 +1248,7 @@ static int fastrpc_internal_mmap(struct fastrpc_apps *me,
 		kfree(map);
 	}
 	kfree(pages);
+	mutex_unlock(&fdata->map_mutex);
 	return err;
 }
 
@@ -1305,6 +1311,7 @@ static int fastrpc_device_release(struct inode *inode, struct file *file)
 			free_map(map, cid);
 			kfree(map);
 		}
+		mutex_destroy(&fdata->map_mutex);
 		kfree(fdata);
 		kref_put_mutex(&me->channel[cid].kref, fastrpc_channel_close,
 				&me->smd_mutex);
@@ -1355,6 +1362,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
 		VERIFY(err, 0 == fastrpc_create_current_dsp_process(cid));
 		if (err)
 			goto bail;
+		mutex_init(&fdata->map_mutex);
 		filp->private_data = fdata;
 bail:
 		if (err) {