From fbb9bcc013965e7cd90d8ed08c1e41b7fd702b3e Mon Sep 17 00:00:00 2001 From: Suren Baghdasaryan Date: Fri, 25 Oct 2019 00:12:58 -0700 Subject: [PATCH] staging: android: ashmem: Disallow ashmem memory from being remapped When ashmem file is being mmapped the resulting vma->vm_file points to the backing shmem file with the generic fops that do not check ashmem permissions like fops of ashmem do. Fix that by disallowing mapping operation for backing shmem file. Bug: 142938932 Bug: 142903466 Reported-by: Jann Horn Signed-off-by: Suren Baghdasaryan Change-Id: I718dfca02c83845f8a41d88506871b0aa21326d7 CVE-2020-0009 Signed-off-by: Kevin F. Haggerty --- drivers/staging/android/ashmem.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 45c81a2a4d8..b1e011fc6a6 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -291,8 +291,23 @@ static inline unsigned long calc_vm_may_flags(unsigned long prot) _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC); } +static int ashmem_vmfile_mmap(struct file *file, struct vm_area_struct *vma) +{ + /* do not allow to mmap ashmem backing shmem file directly */ + return -EPERM; +} + +static unsigned long +ashmem_vmfile_get_unmapped_area(struct file *file, unsigned long addr, + unsigned long len, unsigned long pgoff, + unsigned long flags) +{ + return current->mm->get_unmapped_area(file, addr, len, pgoff, flags); +} + static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) { + static struct file_operations vmfile_fops; struct ashmem_area *asma = file->private_data; int ret = 0; #ifdef CONFIG_TIMA_RKP @@ -334,6 +349,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) goto out; } asma->file = vmfile; + /* + * override mmap operation of the vmfile so that it can't be + * remapped which would lead to creation of a new vma with no + * asma permission checks. Have to override get_unmapped_area + * as well to prevent VM_BUG_ON check for f_ops modification. + */ + if (!vmfile_fops.mmap) { + vmfile_fops = *vmfile->f_op; + vmfile_fops.mmap = ashmem_vmfile_mmap; + vmfile_fops.get_unmapped_area = + ashmem_vmfile_get_unmapped_area; + } + vmfile->f_op = &vmfile_fops; } get_file(asma->file);