Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0d2cea74 authored by qctecmdr's avatar qctecmdr Committed by Gerrit - the friendly Code Review server
Browse files

Merge "msm: adsprpc: Handle UAF in fastrpc debugfs read"

parents 21430fbc 89451b4a

drivers/char/adsprpc.c

+10 −1
Original line number Original line Diff line number Diff line
@@ -3834,6 +3834,7 @@ static ssize_t fastrpc_debugfs_read(struct file *filp, char __user *buffer, 
		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"%s%s%s%s%s\n", single_line, single_line,

			"%s%s%s%s%s\n", single_line, single_line,

			single_line, single_line, single_line);

			single_line, single_line, single_line);

		spin_lock(&me->hlock);

		hlist_for_each_entry_safe(gmaps, n, &me->maps, hn) {

		hlist_for_each_entry_safe(gmaps, n, &me->maps, hn) {

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

				"%-20d|0x%-18llX|0x%-18X|0x%-20lX\n\n",

				"%-20d|0x%-18llX|0x%-18X|0x%-20lX\n\n",
@@ -3841,18 +3842,21 @@ static ssize_t fastrpc_debugfs_read(struct file *filp, char __user *buffer, 
				(uint32_t)gmaps->size,

				(uint32_t)gmaps->size,

				gmaps->va);

				gmaps->va);

		}

		}

		spin_unlock(&me->hlock);

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"%-20s|%-20s|%-20s|%-20s\n",

			"%-20s|%-20s|%-20s|%-20s\n",

			"len", "refs", "raddr", "flags");

			"len", "refs", "raddr", "flags");

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"%s%s%s%s%s\n", single_line, single_line,

			"%s%s%s%s%s\n", single_line, single_line,

			single_line, single_line, single_line);

			single_line, single_line, single_line);

		spin_lock(&me->hlock);

		hlist_for_each_entry_safe(gmaps, n, &me->maps, hn) {

		hlist_for_each_entry_safe(gmaps, n, &me->maps, hn) {

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

				"0x%-18X|%-20d|%-20lu|%-20u\n",

				"0x%-18X|%-20d|%-20lu|%-20u\n",

				(uint32_t)gmaps->len, gmaps->refs,

				(uint32_t)gmaps->len, gmaps->refs,

				gmaps->raddr, gmaps->flags);

				gmaps->raddr, gmaps->flags);

		}

		}

		spin_unlock(&me->hlock);

	} else {

	} else {

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"\n%s %13s %d\n", "cid", ":", fl->cid);

			"\n%s %13s %d\n", "cid", ":", fl->cid);
@@ -3894,12 +3898,14 @@ static ssize_t fastrpc_debugfs_read(struct file *filp, char __user *buffer, 
			"%s%s%s%s%s\n",

			"%s%s%s%s%s\n",

			single_line, single_line, single_line,

			single_line, single_line, single_line,

			single_line, single_line);

			single_line, single_line);

		mutex_lock(&fl->map_mutex);

		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {

		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

				"0x%-20lX|0x%-20llX|0x%-20zu\n\n",

				"0x%-20lX|0x%-20llX|0x%-20zu\n\n",

				map->va, map->phys,

				map->va, map->phys,

				map->size);

				map->size);

		}

		}

		mutex_unlock(&fl->map_mutex);

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"%-20s|%-20s|%-20s|%-20s\n",

			"%-20s|%-20s|%-20s|%-20s\n",

			"len", "refs",

			"len", "refs",
@@ -3908,24 +3914,27 @@ static ssize_t fastrpc_debugfs_read(struct file *filp, char __user *buffer, 
			"%s%s%s%s%s\n",

			"%s%s%s%s%s\n",

			single_line, single_line, single_line,

			single_line, single_line, single_line,

			single_line, single_line);

			single_line, single_line);

		mutex_lock(&fl->map_mutex);

		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {

		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

				"%-20zu|%-20d|0x%-20lX|%-20d\n\n",

				"%-20zu|%-20d|0x%-20lX|%-20d\n\n",

				map->len, map->refs, map->raddr,

				map->len, map->refs, map->raddr,

				map->uncached);

				map->uncached);

		}

		}

		mutex_unlock(&fl->map_mutex);

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"%-20s|%-20s\n", "secure", "attr");

			"%-20s|%-20s\n", "secure", "attr");

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"%s%s%s%s%s\n",

			"%s%s%s%s%s\n",

			single_line, single_line, single_line,

			single_line, single_line, single_line,

			single_line, single_line);

			single_line, single_line);

		mutex_lock(&fl->map_mutex);

		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {

		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

				"%-20d|0x%-20lX\n\n",

				"%-20d|0x%-20lX\n\n",

				map->secure, map->attr);

				map->secure, map->attr);

		}

		}



		mutex_unlock(&fl->map_mutex);

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

		len += scnprintf(fileinfo + len, DEBUGFS_SIZE - len,

			"\n======%s %s %s======\n", title,

			"\n======%s %s %s======\n", title,

			" LIST OF BUFS ", title);

			" LIST OF BUFS ", title);