Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 05d68d50 authored by Himateja Reddy's avatar Himateja Reddy
Browse files

msm: adsprpc: block untrusted apps from creating multiple sessions 



Do not allow untrusted apps to create multiple remote sessions.

Change-Id: Ie5e143099b3e546c7423c9dae1256a9e3fc4d76c
Acked-by: default avatarThyagarajan Venkatanarayanan <venkatan@qti.qualcomm.com>
Signed-off-by: default avatarHimateja Reddy <hmreddy@codeaurora.org>
parent 9c40e1ec

drivers/char/adsprpc.c

+20 −9
Original line number Diff line number Diff line
@@ -591,6 +591,7 @@ struct fastrpc_file { 
	/* IRQ safe spin lock for protecting async queue */

	spinlock_t aqlock;

	uint32_t ws_timeout;

	bool untrusted_process;

};



static struct fastrpc_apps gfa;
@@ -3388,16 +3389,11 @@ static int fastrpc_init_create_dynamic_process(struct fastrpc_file *fl, 
	}

	inbuf.pageslen = 1;



	/*

	 * Third-party apps don't have permission to open the fastrpc device, so

	 * it is opened on their behalf by a trusted process. Such untrusted

	 * apps are not allowed to offload to signedPD on DSP. This is detected

	 * by comparing current PID with the one stored during device open.

	 */

	if (current->tgid != fl->tgid_open) {

	/* Untrusted apps are not allowed to offload to signedPD on DSP. */

	if (fl->untrusted_process) {

		VERIFY(err, uproc->attrs & FASTRPC_MODE_UNSIGNED_MODULE);

		if (err) {

			err = -EINVAL;

			err = -ECONNREFUSED;

			ADSPRPC_ERR(

				"untrusted app trying to offload to signed remote process\n");

			goto bail;
@@ -5299,6 +5295,14 @@ static int fastrpc_set_process_info(struct fastrpc_file *fl) 
	char strpid[PID_SIZE];



	fl->tgid = current->tgid;



	/*

	 * Third-party apps don't have permission to open the fastrpc device, so

	 * it is opened on their behalf by DSP HAL. This is detected by

	 * comparing current PID with the one stored during device open.

	 */

	if (current->tgid != fl->tgid_open)

		fl->untrusted_process = true;

	snprintf(strpid, PID_SIZE, "%d", current->pid);

	if (debugfs_root) {

		buf_size = strlen(current->comm) + strlen("_")
@@ -5513,6 +5517,12 @@ static int fastrpc_setmode(unsigned long ioctl_param, 
		fl->profile = (uint32_t)ioctl_param;

		break;

	case FASTRPC_MODE_SESSION:

		if (fl->untrusted_process) {

			err = -EPERM;

			ADSPRPC_ERR(

				"multiple sessions not allowed for untrusted apps\n");

			goto bail;

		}

		fl->sessionid = 1;

		fl->tgid |= (1 << SESSION_ID_INDEX);

		break;
@@ -5520,6 +5530,7 @@ static int fastrpc_setmode(unsigned long ioctl_param, 
		err = -ENOTTY;

		break;

	}

bail:

	return err;

}
@@ -6148,7 +6159,7 @@ static int fastrpc_cb_probe(struct device *dev) 
	}



	chan->sesscount++;

	if (debugfs_root) {

	if (debugfs_root && !debugfs_global_file) {

		debugfs_global_file = debugfs_create_file("global", 0644,

			debugfs_root, NULL, &debugfs_fops);

		if (IS_ERR_OR_NULL(debugfs_global_file)) {