Merge "msm: adsprpc: Handle UAF in process shell memory" (05f4010b) · Commits · e / devices / android_kernel_sony_msm8998

drivers/char/adsprpc.c

+11 −5

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
		* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -297,6 +297,7 @@ struct fastrpc_mmap {
		int uncached;
		int secure;
		uintptr_t attr;
		bool is_filemap; /flag to indicate map used in process init/
		};

		struct fastrpc_perf {
		@@ -556,9 +557,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,

		spin_lock(&me->hlock);
		hlist_for_each_entry_safe(map, n, &me->maps, hn) {
		if (map->raddr == va &&
		if (map->refs == 1 && map->raddr == va &&
		map->raddr + map->len == va + len &&
		map->refs == 1) {
		/Remove map if not used in process initialization/
		!map->is_filemap) {
		match = map;
		hlist_del_init(&map->hn);
		break;
		@@ -571,9 +573,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, uintptr_t va,
		}
		spin_lock(&fl->hlock);
		hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
		if (map->raddr == va &&
		if (map->refs == 1 && map->raddr == va &&
		map->raddr + map->len == va + len &&
		map->refs == 1) {
		/Remove map if not used in process initialization/
		!map->is_filemap) {
		match = map;
		hlist_del_init(&map->hn);
		break;
		@@ -711,6 +714,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, unsigned attr,
		map->fl = fl;
		map->fd = fd;
		map->attr = attr;
		map->is_filemap = false;
		if (mflags == ADSP_MMAP_HEAP_ADDR \|\|
		mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
		DEFINE_DMA_ATTRS(rh_attrs);
		@@ -1900,6 +1904,8 @@ static int fastrpc_init_process(struct fastrpc_file *fl,
		if (init->filelen) {
		VERIFY(err, !fastrpc_mmap_create(fl, init->filefd, 0,
		init->file, init->filelen, mflags, &file));
		if (file)
		file->is_filemap = true;
		if (err)
		goto bail;
		}