Browse Source

msm: adsprpc: Handle UAF in process shell memory

Added flag to indicate memory used
in process initialization. And, this memory
would not removed in internal unmap to avoid
UAF or double free.

Change-Id: Ie470fe58ac334421d186feb41fa67bd24bb5efea
Signed-off-by: DEEPAK SANNAPAREDDY <[email protected]>
DEEPAK SANNAPAREDDY 1 năm trước cách đây
mục cha
commit
3a1e7d8111
1 tập tin đã thay đổi với 2 bổ sung0 xóa
  1. 2 0
      dsp/adsprpc.c

+ 2 - 0
dsp/adsprpc.c

@@ -4351,6 +4351,8 @@ static int fastrpc_init_create_static_process(struct fastrpc_file *fl,
 			mutex_lock(&fl->map_mutex);
 			mutex_lock(&fl->map_mutex);
 			err = fastrpc_mmap_create(fl, -1, NULL, 0, init->mem,
 			err = fastrpc_mmap_create(fl, -1, NULL, 0, init->mem,
 				 init->memlen, ADSP_MMAP_REMOTE_HEAP_ADDR, &mem);
 				 init->memlen, ADSP_MMAP_REMOTE_HEAP_ADDR, &mem);
+			if (mem)
+				mem->is_filemap = true;
 			mutex_unlock(&fl->map_mutex);
 			mutex_unlock(&fl->map_mutex);
 			if (err || (!mem))
 			if (err || (!mem))
 				goto bail;
 				goto bail;