Merge "msm: adsprpc: Handle UAF in process shell memory" (9d9d2dad) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/char/adsprpc.c

+11 −4

Original line number	Diff line number	Diff line
		@@ -415,6 +415,8 @@ struct fastrpc_mmap {
		int uncached;
		int secure;
		uintptr_t attr;
		bool is_filemap;
		/* flag to indicate map used in process init */
		};

		enum fastrpc_perfkeys {
		@@ -833,9 +835,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,

		spin_lock(&me->hlock);
		hlist_for_each_entry_safe(map, n, &me->maps, hn) {
		if (map->raddr == va &&
		if (map->refs == 1 && map->raddr == va &&
		map->raddr + map->len == va + len &&
		map->refs == 1) {
		/* Remove map if not used in process initialization*/
		!map->is_filemap) {
		match = map;
		hlist_del_init(&map->hn);
		break;
		@@ -847,9 +850,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,
		return 0;
		}
		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
		if (map->raddr == va &&
		if (map->refs == 1 && map->raddr == va &&
		map->raddr + map->len == va + len &&
		map->refs == 1) {
		/* Remove map if not used in process initialization*/
		!map->is_filemap) {
		match = map;
		hlist_del_init(&map->hn);
		break;
		@@ -985,6 +989,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
		map->fl = fl;
		map->fd = fd;
		map->attr = attr;
		map->is_filemap = false;
		if (mflags == ADSP_MMAP_HEAP_ADDR \|\|
		mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
		map->apps = me;
		@@ -2585,6 +2590,8 @@ static int fastrpc_init_process(struct fastrpc_file *fl,
		mutex_lock(&fl->map_mutex);
		VERIFY(err, !fastrpc_mmap_create(fl, init->filefd, 0,
		init->file, init->filelen, mflags, &file));
		if (file)
		file->is_filemap = true;
		mutex_unlock(&fl->map_mutex);
		if (err)
		goto bail;