Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

ashmem: remove cache maintenance support

Browse source 
The cache maintenance routines in ashmem were causing
several security issues. Since they are not being used
anymore by any drivers, its well to remove them entirely.

Bug: 34126808
Bug: 34173755
Bug: 34203176
CRs-Fixed: 1107034, 2001129, 2007786
Change-Id: I955e33d90b888d58db5cf6bb490905283374425b
Signed-off-by: Sudarshan Rajagopalan <sudaraja@codeaurora.org>
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
(cherry picked from commit e7f623aa1b8ba3b843c70eeae99aae95bddfe03d)
This commit is contained in:
Dennis Cagle 2017-05-04 15:26:32 -07:00 committed by Sean McCreary
parent 1fd1850bf6
commit deb2e4d71c
2 changed files with 0 additions and 58 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
drivers/staging/android/ashmem.c
View file

@ -29,7 +29,6 @@
#include <linux/mutex.h>
#include <linux/shmem_fs.h>
#include <linux/ashmem.h>
#include <asm/cacheflush.h>
#define ASHMEM_NAME_PREFIX "dev/ashmem/"
#define ASHMEM_NAME_PREFIX_LEN (sizeof(ASHMEM_NAME_PREFIX) - 1)
@ -681,51 +680,6 @@ done:
}
#endif
static int ashmem_cache_op(struct ashmem_area *asma,
void (*cache_func)(unsigned long vstart, unsigned long length,
unsigned long pstart))
{
int ret = 0;
struct vm_area_struct *vma;
#ifdef CONFIG_OUTER_CACHE
unsigned long vaddr;
#endif
if (!asma->vm_start)
return -EINVAL;
down_read(&current->mm->mmap_sem);
vma = find_vma(current->mm, asma->vm_start);
if (!vma) {
ret = -EINVAL;
goto done;
}
if (vma->vm_file != asma->file) {
ret = -EINVAL;
goto done;
}
if ((asma->vm_start + asma->size) > vma->vm_end) {
ret = -EINVAL;
goto done;
}
#ifndef CONFIG_OUTER_CACHE
cache_func(asma->vm_start, asma->size, 0);
#else
for (vaddr = asma->vm_start; vaddr < asma->vm_start + asma->size;
vaddr += PAGE_SIZE) {
unsigned long physaddr;
physaddr = virtaddr_to_physaddr(vaddr);
if (!physaddr)
return -EINVAL;
cache_func(vaddr, PAGE_SIZE, physaddr);
}
#endif
done:
up_read(&current->mm->mmap_sem);
if (ret)
asma->vm_start = 0;
return ret;
}
static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
struct ashmem_area *asma = file->private_data;
@ -773,15 +727,6 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
ashmem_shrink(&ashmem_shrinker, &sc);
}
break;
case ASHMEM_CACHE_FLUSH_RANGE:
ret = ashmem_cache_op(asma, &clean_and_invalidate_caches);
break;
case ASHMEM_CACHE_CLEAN_RANGE:
ret = ashmem_cache_op(asma, &clean_caches);
break;
case ASHMEM_CACHE_INV_RANGE:
ret = ashmem_cache_op(asma, &invalidate_caches);
break;
}
return ret;

3
include/linux/ashmem.h
View file

@ -44,9 +44,6 @@ struct ashmem_pin {
#define ASHMEM_UNPIN _IOW(__ASHMEMIOC, 8, struct ashmem_pin)
#define ASHMEM_GET_PIN_STATUS _IO(__ASHMEMIOC, 9)
#define ASHMEM_PURGE_ALL_CACHES _IO(__ASHMEMIOC, 10)
#define ASHMEM_CACHE_FLUSH_RANGE _IO(__ASHMEMIOC, 11)
#define ASHMEM_CACHE_CLEAN_RANGE _IO(__ASHMEMIOC, 12)
#define ASHMEM_CACHE_INV_RANGE _IO(__ASHMEMIOC, 13)
int get_ashmem_file(int fd, struct file **filp, struct file **vm_file,
unsigned long *len);