Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb51f942 authored by Tharun Kumar Merugu's avatar Tharun Kumar Merugu
Browse files

msm: adsprpc: Use unsigned integer for length values 



As the length datatype is signed, an attacker can both overflow
the calculation or supply a negative number to trick the check
into returning an chosen chunk. This can have undesired
consequences. Always use unsigned integer types for length
values

Change-Id: Ifde2f0d35129014b976507f7723a319c53fabddf
Acked-by: default avatarThyagarajan Venkatanarayanan <venkatan@qti.qualcomm.com>
Signed-off-by: default avatarTharun Kumar Merugu <mtharu@codeaurora.org>
parent 3b61f587

drivers/char/adsprpc.c

+37 −33
Original line number Diff line number Diff line
@@ -117,11 +117,11 @@ static inline uint64_t buf_page_offset(uint64_t buf) 
	return offset;

}



static inline int buf_num_pages(uint64_t buf, ssize_t len)

static inline uint64_t buf_num_pages(uint64_t buf, size_t len)

{

	uint64_t start = buf_page_start(buf) >> PAGE_SHIFT;

	uint64_t end = (((uint64_t) buf + len - 1) & PAGE_MASK) >> PAGE_SHIFT;

	int nPages = end - start + 1;

	uint64_t nPages = end - start + 1;

	return nPages;

}
@@ -153,7 +153,7 @@ struct fastrpc_buf { 
	struct fastrpc_file *fl;

	void *virt;

	uint64_t phys;

	ssize_t size;

	size_t size;

};



struct fastrpc_ctx_lst;
@@ -179,7 +179,7 @@ struct smq_invoke_ctx { 
	unsigned int *attrs;

	struct fastrpc_mmap **maps;

	struct fastrpc_buf *buf;

	ssize_t used;

	size_t used;

	struct fastrpc_file *fl;

	uint32_t sc;

	struct overlap *overs;
@@ -268,9 +268,9 @@ struct fastrpc_mmap { 
	struct dma_buf_attachment *attach;

	struct ion_handle *handle;

	uint64_t phys;

	ssize_t size;

	uintptr_t __user va;

	ssize_t len;

	size_t size;

	uintptr_t va;

	size_t len;

	int refs;

	uintptr_t raddr;

	int uncached;
@@ -424,12 +424,15 @@ static void fastrpc_mmap_add(struct fastrpc_mmap *map) 
}



static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,

		uintptr_t __user va, ssize_t len, int mflags, int refs,

		uintptr_t va, size_t len, int mflags, int refs,

		struct fastrpc_mmap **ppmap)

{

	struct fastrpc_apps *me = &gfa;

	struct fastrpc_mmap *match = NULL, *map = NULL;

	struct hlist_node *n;



	if ((va + len) < va)

		return -EOVERFLOW;

	if (mflags == ADSP_MMAP_HEAP_ADDR ||

				 mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {

		spin_lock(&me->hlock);
@@ -465,7 +468,7 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd, 
	return -ENOTTY;

}



static int dma_alloc_memory(phys_addr_t *region_start, ssize_t size)

static int dma_alloc_memory(phys_addr_t *region_start, size_t size)

{

	struct fastrpc_apps *me = &gfa;

	void *vaddr = NULL;
@@ -484,7 +487,7 @@ static int dma_alloc_memory(phys_addr_t *region_start, ssize_t size) 
}



static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,

			       ssize_t len, struct fastrpc_mmap **ppmap)

			       size_t len, struct fastrpc_mmap **ppmap)

{

	struct fastrpc_mmap *match = NULL, *map;

	struct hlist_node *n;
@@ -603,7 +606,7 @@ static int fastrpc_session_alloc(struct fastrpc_channel_ctx *chan, int secure, 
					struct fastrpc_session_ctx **session);



static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,

	unsigned int attr, uintptr_t __user va, ssize_t len, int mflags,

	unsigned int attr, uintptr_t va, size_t len, int mflags,

	struct fastrpc_mmap **ppmap)

{

	struct fastrpc_apps *me = &gfa;
@@ -638,7 +641,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
			goto bail;

		map->phys = (uintptr_t)region_start;

		map->size = len;

		map->va = (uintptr_t __user)map->phys;

		map->va = (uintptr_t)map->phys;

	} else {

		if (map->attr && (map->attr & FASTRPC_ATTR_KEEP_MAP)) {

			pr_info("adsprpc: buffer mapped with persist attr %x\n",
@@ -740,7 +743,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, 
	return err;

}



static int fastrpc_buf_alloc(struct fastrpc_file *fl, ssize_t size,

static int fastrpc_buf_alloc(struct fastrpc_file *fl, size_t size,

			     struct fastrpc_buf **obuf)

{

	int err = 0, vmid;
@@ -1118,7 +1121,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	int outbufs = REMOTE_SCALARS_OUTBUFS(sc);

	int handles, bufs = inbufs + outbufs;

	uintptr_t args;

	ssize_t rlen = 0, copylen = 0, metalen = 0;

	size_t rlen = 0, copylen = 0, metalen = 0;

	int i, oix;

	int err = 0;

	int mflags = 0;
@@ -1132,8 +1135,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	ipage = pages;



	for (i = 0; i < bufs; ++i) {

		uintptr_t __user buf = (uintptr_t __user)lpra[i].buf.pv;

		ssize_t len = lpra[i].buf.len;

		uintptr_t buf = (uintptr_t)lpra[i].buf.pv;

		size_t len = lpra[i].buf.len;



		if (ctx->fds[i] && (ctx->fds[i] != -1))

			fastrpc_mmap_create(ctx->fl, ctx->fds[i],
@@ -1149,14 +1152,14 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
			goto bail;

		ipage += 1;

	}

	metalen = copylen = (ssize_t)&ipage[0] + (sizeof(uint64_t) * M_FDLIST) +

	metalen = copylen = (size_t)&ipage[0] + (sizeof(uint64_t) * M_FDLIST) +

				 (sizeof(uint32_t) * M_CRCLIST);



	/* calculate len requreed for copying */

	for (oix = 0; oix < inbufs + outbufs; ++oix) {

		int i = ctx->overps[oix]->raix;

		uintptr_t mstart, mend;

		ssize_t len = lpra[i].buf.len;

		size_t len = lpra[i].buf.len;



		if (!len)

			continue;
@@ -1206,7 +1209,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	for (i = 0; rpra && i < inbufs + outbufs; ++i) {

		struct fastrpc_mmap *map = ctx->maps[i];

		uint64_t buf = ptr_to_uint64(lpra[i].buf.pv);

		ssize_t len = lpra[i].buf.len;

		size_t len = lpra[i].buf.len;



		rpra[i].buf.pv = 0;

		rpra[i].buf.len = len;
@@ -1215,7 +1218,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
		if (map) {

			struct vm_area_struct *vma;

			uintptr_t offset;

			int num = buf_num_pages(buf, len);

			uint64_t num = buf_num_pages(buf, len);

			int idx = list[i].pgidx;



			if (map->attr & FASTRPC_ATTR_NOVA) {
@@ -1258,9 +1261,9 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) 
	for (oix = 0; oix < inbufs + outbufs; ++oix) {

		int i = ctx->overps[oix]->raix;

		struct fastrpc_mmap *map = ctx->maps[i];

		ssize_t mlen;

		size_t mlen;

		uint64_t buf;

		ssize_t len = lpra[i].buf.len;

		size_t len = lpra[i].buf.len;



		if (!len)

			continue;
@@ -1647,9 +1650,9 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
		int mflags = 0;

		struct {

			int pgid;

			int namelen;

			int filelen;

			int pageslen;

			unsigned int namelen;

			unsigned int filelen;

			unsigned int pageslen;

			int attrs;

			int siglen;

		} inbuf;
@@ -1658,14 +1661,15 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
		inbuf.namelen = strlen(current->comm) + 1;

		inbuf.filelen = init->filelen;

		fl->pd = 1;



		if (init->filelen) {

			VERIFY(err, !fastrpc_mmap_create(fl, init->filefd, 0,

				init->file, init->filelen, mflags, &file));

			if (err)

				goto bail;

		}



		inbuf.pageslen = 1;



		VERIFY(err, !fastrpc_mmap_create(fl, init->memfd, 0,

				init->mem, init->memlen, mflags, &mem));

		if (err)
@@ -1714,12 +1718,12 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
	} else if (init->flags == FASTRPC_INIT_CREATE_STATIC) {

		remote_arg_t ra[3];

		uint64_t phys = 0;

		ssize_t size = 0;

		size_t size = 0;

		int fds[3];

		struct {

			int pgid;

			int namelen;

			int pageslen;

			unsigned int namelen;

			unsigned int pageslen;

		} inbuf;



		if (!init->filelen)
@@ -1961,7 +1965,7 @@ static int fastrpc_munmap_on_dsp(struct fastrpc_file *fl, 
	struct {

		int pid;

		uintptr_t vaddrout;

		ssize_t size;

		size_t size;

	} inargs;



	inargs.pid = fl->tgid;
@@ -2040,7 +2044,7 @@ static int fastrpc_mmap_remove_ssr(struct fastrpc_file *fl) 
}



static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,

			     ssize_t len, struct fastrpc_mmap **ppmap);

			     size_t len, struct fastrpc_mmap **ppmap);



static void fastrpc_mmap_add(struct fastrpc_mmap *map);
@@ -2093,12 +2097,12 @@ static int fastrpc_internal_mmap(struct fastrpc_file *fl, 
	struct fastrpc_mmap *map = NULL;

	int err = 0;



	if (!fastrpc_mmap_find(fl, ud->fd, (uintptr_t __user)ud->vaddrin,

	if (!fastrpc_mmap_find(fl, ud->fd, (uintptr_t)ud->vaddrin,

			 ud->size, ud->flags, 1, &map))

		return 0;



	VERIFY(err, !fastrpc_mmap_create(fl, ud->fd, 0,

			(uintptr_t __user)ud->vaddrin, ud->size,

			(uintptr_t)ud->vaddrin, ud->size,

			 ud->flags, &map));

	if (err)

		goto bail;

drivers/char/adsprpc_compat.c

+6 −6
Original line number Diff line number Diff line
@@ -42,7 +42,7 @@ 


struct compat_remote_buf {

	compat_uptr_t pv;	/* buffer pointer */

	compat_ssize_t len;	/* length of buffer */

	compat_size_t len;	/* length of buffer */

};



union compat_remote_arg {
@@ -78,13 +78,13 @@ struct compat_fastrpc_ioctl_mmap { 
	compat_int_t fd;	/* ion fd */

	compat_uint_t flags;	/* flags for dsp to map with */

	compat_uptr_t vaddrin;	/* optional virtual address */

	compat_ssize_t size;	/* size */

	compat_size_t size;	/* size */

	compat_uptr_t vaddrout;	/* dsps virtual address */

};



struct compat_fastrpc_ioctl_munmap {

	compat_uptr_t vaddrout;	/* address to unmap */

	compat_ssize_t size;	/* size */

	compat_size_t size;	/* size */

};



struct compat_fastrpc_ioctl_init {
@@ -128,7 +128,7 @@ static int compat_get_fastrpc_ioctl_invoke( 
			unsigned int cmd)

{

	compat_uint_t u, sc;

	compat_ssize_t s;

	compat_size_t s;

	compat_uptr_t p;

	struct fastrpc_ioctl_invoke_crc *inv;

	union compat_remote_arg *pra32;
@@ -190,7 +190,7 @@ static int compat_get_fastrpc_ioctl_mmap( 
{

	compat_uint_t u;

	compat_int_t i;

	compat_ssize_t s;

	compat_size_t s;

	compat_uptr_t p;

	int err;
@@ -224,7 +224,7 @@ static int compat_get_fastrpc_ioctl_munmap( 
			struct fastrpc_ioctl_munmap __user *unmap)

{

	compat_uptr_t p;

	compat_ssize_t s;

	compat_size_t s;

	int err;



	err = get_user(p, &unmap32->vaddrout);

drivers/char/adsprpc_shared.h

+14 −14
Original line number Diff line number Diff line
@@ -122,7 +122,7 @@ do {\ 


struct remote_buf64 {

	uint64_t pv;

	int64_t len;

	uint64_t len;

};



struct remote_dma_handle64 {
@@ -141,7 +141,7 @@ union remote_arg64 { 


struct remote_buf {

	void *pv;		/* buffer pointer */

	ssize_t len;		/* length of buffer */

	size_t len;		/* length of buffer */

};



struct remote_dma_handle {
@@ -181,30 +181,30 @@ struct fastrpc_ioctl_invoke_crc { 


struct fastrpc_ioctl_init {

	uint32_t flags;		/* one of FASTRPC_INIT_* macros */

	uintptr_t __user file;	/* pointer to elf file */

	int32_t filelen;	/* elf file length */

	uintptr_t file;		/* pointer to elf file */

	uint32_t filelen;	/* elf file length */

	int32_t filefd;		/* ION fd for the file */

	uintptr_t __user mem;	/* mem for the PD */

	int32_t memlen;		/* mem length */

	uintptr_t mem;		/* mem for the PD */

	uint32_t memlen;	/* mem length */

	int32_t memfd;		/* ION fd for the mem */

};



struct fastrpc_ioctl_init_attrs {

		struct fastrpc_ioctl_init init;

		int attrs;

		int siglen;

		unsigned int siglen;

};



struct fastrpc_ioctl_munmap {

	uintptr_t vaddrout;	/* address to unmap */

	ssize_t size;		/* size */

	size_t size;		/* size */

};



struct fastrpc_ioctl_mmap {

	int fd;				/* ion fd */

	uint32_t flags;			/* flags for dsp to map with */

	uintptr_t __user *vaddrin;	/* optional virtual address */

	ssize_t size;			/* size */

	uintptr_t vaddrin;		/* optional virtual address */

	size_t size;			/* size */

	uintptr_t vaddrout;		/* dsps virtual address */

};
@@ -216,9 +216,9 @@ struct fastrpc_ioctl_munmap_fd { 
};



struct fastrpc_ioctl_perf {			/* kernel performance data */

	uintptr_t __user data;

	uintptr_t data;

	uint32_t numkeys;

	uintptr_t __user keys;

	uintptr_t keys;

};



#define FASTRPC_CONTROL_LATENCY   (1)
@@ -269,7 +269,7 @@ struct smq_invoke_rsp { 
static inline struct smq_invoke_buf *smq_invoke_buf_start(remote_arg64_t *pra,

							uint32_t sc)

{

	int len = REMOTE_SCALARS_LENGTH(sc);

	unsigned int len = REMOTE_SCALARS_LENGTH(sc);



	return (struct smq_invoke_buf *)(&pra[len]);

}
@@ -277,7 +277,7 @@ static inline struct smq_invoke_buf *smq_invoke_buf_start(remote_arg64_t *pra, 
static inline struct smq_phy_page *smq_phy_page_start(uint32_t sc,

						struct smq_invoke_buf *buf)

{

	int nTotal = REMOTE_SCALARS_LENGTH(sc);

	unsigned int nTotal = REMOTE_SCALARS_LENGTH(sc);



	return (struct smq_phy_page *)(&buf[nTotal]);

}