Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f1c3ed7 authored by Vamsi Krishna Gattupalli's avatar Vamsi Krishna Gattupalli
Browse files

msm: ADSPRPC: Fix to avoid Use after free in fastrpc_init_process



Allow single thread to execute FASTRPC_INIT_CREATE
to avoid UAF scenario.

Change-Id: Id4ba1a406ace04d46482cd8b14c9d9ef5c96c4a1
Acked-by: default avatarNishant Chaubey <chaubey@qti.qualcomm.com>
Signed-off-by: default avatarVamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
parent 1c29131b
Loading
Loading
Loading
Loading
+18 −0
Original line number Diff line number Diff line
@@ -482,6 +482,8 @@ struct fastrpc_file {
	uint32_t ws_timeout;
	/* To indicate attempt has been made to allocate memory for debug_buf */
	int debug_buf_alloced_attempted;
	/* Flag to indicate dynamic process creation status*/
	bool in_process_create;
};

static struct fastrpc_apps gfa;
@@ -2577,6 +2579,15 @@ static int fastrpc_init_process(struct fastrpc_file *fl,
			int siglen;
		} inbuf;

		spin_lock(&fl->hlock);
		if (fl->in_process_create) {
			err = -EALREADY;
			pr_err("Already in create init process\n");
			spin_unlock(&fl->hlock);
			return err;
		}
		fl->in_process_create = true;
		spin_unlock(&fl->hlock);
		inbuf.pgid = fl->tgid;
		inbuf.namelen = strlen(current->comm) + 1;
		inbuf.filelen = init->filelen;
@@ -2788,6 +2799,11 @@ static int fastrpc_init_process(struct fastrpc_file *fl,
		fastrpc_mmap_free(file, 0);
		mutex_unlock(&fl->map_mutex);
	}
	if (init->flags == FASTRPC_INIT_CREATE) {
		spin_lock(&fl->hlock);
		fl->in_process_create = false;
		spin_unlock(&fl->hlock);
	}
	return err;
}

@@ -3700,6 +3716,7 @@ static int fastrpc_file_free(struct fastrpc_file *fl)
	}
	spin_lock(&fl->hlock);
	fl->file_close = 1;
	fl->in_process_create = false;
	spin_unlock(&fl->hlock);
	if (!IS_ERR_OR_NULL(fl->init_mem))
		fastrpc_buf_free(fl->init_mem, 0);
@@ -4101,6 +4118,7 @@ static int fastrpc_device_open(struct inode *inode, struct file *filp)
	fl->cid = -1;
	fl->dev_minor = dev_minor;
	fl->init_mem = NULL;
	fl->in_process_create = false;
	memset(&fl->perf, 0, sizeof(fl->perf));
	fl->qos_request = 0;
	fl->dsp_proc_init = 0;