@@ -303,6 +303,7 @@ struct fastrpc_user {
int pd;
bool is_secure_dev;
bool is_unsigned_pd;
+ bool untrusted_process;
/* Lock for lists */
spinlock_t lock;
/* lock for allocations */
@@ -1208,20 +1209,24 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl, u32 kernel,
static bool is_session_rejected(struct fastrpc_user *fl, bool unsigned_pd_request)
{
- /* Check if the device node is non-secure and channel is secure*/
+ /* Check if the device node is non-secure and channel is secure */
if (!fl->is_secure_dev && fl->cctx->secure) {
/*
* Allow untrusted applications to offload only to Unsigned PD when
* channel is configured as secure and block untrusted apps on channel
* that does not support unsigned PD offload
*/
- if (!fl->cctx->unsigned_support || !unsigned_pd_request) {
- dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD");
- return true;
- }
+ if (!fl->cctx->unsigned_support || !unsigned_pd_request)
+ goto reject_session;
}
+ /* Check if untrusted process is trying to offload to signed PD */
+ if (fl->untrusted_process && !unsigned_pd_request)
+ goto reject_session;
return false;
+reject_session:
+ dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD");
+ return true;
}
static int fastrpc_mmap_remove_ssr(struct fastrpc_channel_ctx *cctx)
@@ -1274,6 +1279,11 @@ static int fastrpc_init_create_static_process(struct fastrpc_user *fl,
} inbuf;
u32 sc;
+ if (!fl->is_secure_dev) {
+ dev_err(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n");
+ return -EACCES;
+ }
+
args = kcalloc(FASTRPC_CREATE_STATIC_PROCESS_NARGS, sizeof(*args), GFP_KERNEL);
if (!args)
return -ENOMEM;
@@ -1420,11 +1430,19 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
goto err;
}
+ /*
+ * Third-party apps don't have permission to open the fastrpc device, so
+ * it is opened on their behalf by DSP HAL. This is detected by
+ * comparing current PID with the one stored during device open.
+ */
+ if (current->tgid != fl->tgid)
+ fl->untrusted_process = true;
+
if (init.attrs & FASTRPC_MODE_UNSIGNED_MODULE)
fl->is_unsigned_pd = true;
if (is_session_rejected(fl, fl->is_unsigned_pd)) {
- err = -ECONNREFUSED;
+ err = -EACCES;
goto err;
}
@@ -1688,6 +1706,11 @@ static int fastrpc_init_attach(struct fastrpc_user *fl, int pd)
int tgid = fl->tgid;
u32 sc;
+ if (!fl->is_secure_dev) {
+ dev_err(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n");
+ return -EACCES;
+ }
+
args[0].ptr = (u64)(uintptr_t) &tgid;
args[0].length = sizeof(tgid);
args[0].fd = -1;
Untrusted application can attach to guestOS and staticPD if it can make root PD, sensors PD or audio PD attach request. This is a potential security issue as the untrusted application can crash rootPD or staticPD. Restrict attach to guestOS or staticPD request if request is being made using non-secure device node. Also for untrusted dynamic processes, DSP HAL process opens the device node on behalf of the application. Add a check to restrict such untrusted applications from offloading to signed PD. Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com> --- drivers/misc/fastrpc.c | 35 +++++++++++++++++++++++++++++------ 1 file changed, 29 insertions(+), 6 deletions(-)