evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fbdev: msm: Avoid UAF in mdss_dsi_cmd_write

Browse source 
In mdss_dsi_cmd_write, a failure in copying the cmds to
'string_buf' can cause an early return. In this case,
the 'pcmds->string_buf' won't be pointing to a valid
buffer. This can lead to use-after-free and memory leak.
To avoid this, assign the newly allocated buffer to
'pcmds->string_buf' after returning from krealloc call.

Change-Id: I286f12c86078d1989cb09453c8a395a4ad94b324
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
This commit is contained in:
Nirmal Abraham 2019-08-16 16:39:17 +05:30 • committed by Gerrit - the friendly Code Review server
parent c65b958524
commit 6dec23e2d3
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/video/fbdev/msm/mdss_dsi.c
View file

@ -888,7 +888,7 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
{ {
struct buf_data *pcmds = file->private_data; struct buf_data *pcmds = file->private_data;
ssize_t ret = 0; ssize_t ret = 0;
int blen = 0; unsigned int blen = 0;
char *string_buf; char *string_buf;
mutex_lock(&pcmds->dbg_mutex); mutex_lock(&pcmds->dbg_mutex);
@ -900,6 +900,11 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
/* Allocate memory for the received string */ /* Allocate memory for the received string */
blen = count + (pcmds->sblen); blen = count + (pcmds->sblen);
if (blen > U32_MAX - 1) {
mutex_unlock(&pcmds->dbg_mutex);
return -EINVAL;
}
string_buf = krealloc(pcmds->string_buf, blen + 1, GFP_KERNEL); string_buf = krealloc(pcmds->string_buf, blen + 1, GFP_KERNEL);
if (!string_buf) { if (!string_buf) {
pr_err("%s: Failed to allocate memory\n", __func__); pr_err("%s: Failed to allocate memory\n", __func__);
@ -907,6 +912,7 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
return -ENOMEM; return -ENOMEM;
} }
pcmds->string_buf = string_buf;
/* Writing in batches is possible */ /* Writing in batches is possible */
ret = simple_write_to_buffer(string_buf, blen, ppos, p, count); ret = simple_write_to_buffer(string_buf, blen, ppos, p, count);
if (ret < 0) { if (ret < 0) {
@ -916,7 +922,6 @@ static ssize_t mdss_dsi_cmd_write(struct file *file, const char __user *p,
} }
string_buf[ret] = '\0'; string_buf[ret] = '\0';
pcmds->string_buf = string_buf;
pcmds->sblen = count; pcmds->sblen = count;
mutex_unlock(&pcmds->dbg_mutex); mutex_unlock(&pcmds->dbg_mutex);
return ret; return ret;