Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51e05ee9 authored by prabha's avatar prabha
Browse files

msm: adsprpc: Handle UAF in process shell memory 



Added flag to indicate memory used
in process initialization. And, this memory
would not removed in internal unmap to avoid
UAF or double free.

Change-Id: Ie470fe58ac334421d186feb41fa67bd24bb5efea
Signed-off-by: default avatarprabha <prabha@codeaurora.org>
parent 01f96ccc

drivers/char/adsprpc.c

+2 −0
Original line number Original line Diff line number Diff line
@@ -2701,6 +2701,8 @@ static int fastrpc_init_process(struct fastrpc_file *fl, 
			err = fastrpc_mmap_create(fl, -1, 0, init->mem,

			err = fastrpc_mmap_create(fl, -1, 0, init->mem,

				 init->memlen, ADSP_MMAP_REMOTE_HEAP_ADDR,

				 init->memlen, ADSP_MMAP_REMOTE_HEAP_ADDR,

				 &mem);

				 &mem);

			if (mem)

				mem->is_filemap = true;

			mutex_unlock(&fl->map_mutex);

			mutex_unlock(&fl->map_mutex);

			if (err)

			if (err)

				goto bail;

				goto bail;