linux-kernel - [PATCH v1 1/3] misc: fastrpc: Reset metadata buffer to avoid incorrect free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1695973360-14369-2-git-send-email-quic_ekangupt@quicinc.com>
Date:   Fri, 29 Sep 2023 13:12:38 +0530
From:   Ekansh Gupta <quic_ekangupt@...cinc.com>
To:     <srinivas.kandagatla@...aro.org>, <linux-arm-msm@...r.kernel.org>
CC:     Ekansh Gupta <quic_ekangupt@...cinc.com>,
        <ekangupt@....qualcomm.com>, <gregkh@...uxfoundation.org>,
        <linux-kernel@...r.kernel.org>,
        <fastrpc.upstream@....qualcomm.com>, stable <stable@...nel.org>
Subject: [PATCH v1 1/3] misc: fastrpc: Reset metadata buffer to avoid incorrect free

Metadata buffer is allocated during get_args for any remote call.
This buffer carries buffers, fdlists and other payload information
for the call. If the buffer is not reset, put_args might find some
garbage FDs in the fdlist which might have an existing mapping in
the list. This could result in improper freeing of FD map when DSP
might still be using the buffer. Added change to reset the metadata
buffer after allocation.

Fixes: 8f6c1d8c4f0c ("misc: fastrpc: Add fdlist implementation")
Cc: stable <stable@...nel.org>
Signed-off-by: Ekansh Gupta <quic_ekangupt@...cinc.com>
---
 drivers/misc/fastrpc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index a66b7c1..fb92197 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -958,6 +958,7 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx)
 	if (err)
 		return err;
 
+	memset(ctx->buf->virt, 0, pkt_size);
 	rpra = ctx->buf->virt;
 	list = fastrpc_invoke_buf_start(rpra, ctx->nscalars);
 	pages = fastrpc_phy_page_start(list, ctx->nscalars);
-- 
2.7.4