samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

msm: adsprpc : Fix use after free in fastrpc_internal_mem_unmap

Browse Source 
Thread 1 can make a to call fastrpc_mmap_create under internal mem map
and release fl->map_mutex. Thread 2 can make call to internal mem unmap,
acquire fl->map_mutex and get same map though fastrpc_mmap_remove.
Thread 1 fail in fastrpc_mem_map_to_dsp jumps to bail and do map free.
Thread 2 still holds same map which can lead use after free. Serialize
fastrpc internal mem map and unmap.

Change-Id: I54a3602914b43fc67635c0de193bd21aa13daaa3
Signed-off-by: DEEPAK SANNAPAREDDY <quic_sdeeredd@quicinc.com>
This commit is contained in:
DEEPAK SANNAPAREDDY
2023-10-09 11:48:56 +05:30
parent 3a1e7d8111
commit 98ca55499e
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
dsp/adsprpc.c
View File

@@ -5478,6 +5478,7 @@ int fastrpc_internal_mem_map(struct fastrpc_file *fl,
int err = 0; int err = 0;
struct fastrpc_mmap *map = NULL; struct fastrpc_mmap *map = NULL;
mutex_lock(&fl->internal_map_mutex);
VERIFY(err, fl->dsp_proc_init == 1); VERIFY(err, fl->dsp_proc_init == 1);
if (err) { if (err) {
pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n", pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n",
@@ -5516,6 +5517,7 @@ bail:
mutex_unlock(&fl->map_mutex); mutex_unlock(&fl->map_mutex);
} }
} }
mutex_unlock(&fl->internal_map_mutex);
return err; return err;
} }
@@ -5526,6 +5528,7 @@ int fastrpc_internal_mem_unmap(struct fastrpc_file *fl,
struct fastrpc_mmap *map = NULL; struct fastrpc_mmap *map = NULL;
size_t map_size = 0; size_t map_size = 0;
mutex_lock(&fl->internal_map_mutex);
VERIFY(err, fl->dsp_proc_init == 1); VERIFY(err, fl->dsp_proc_init == 1);
if (err) { if (err) {
pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n", pr_err("adsprpc: ERROR: %s: user application %s trying to map without initialization\n",
@@ -5572,6 +5575,7 @@ bail:
mutex_unlock(&fl->map_mutex); mutex_unlock(&fl->map_mutex);
} }
} }
mutex_unlock(&fl->internal_map_mutex);
return err; return err;
} }