tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

Revert "misc: fastrpc: Restrict untrusted app to attach to privileged PD"

This reverts commit bab2f5e8fd5d2f759db26b78d9db57412888f187.

Joel reported that this commit breaks userspace and stops sensors in
SDM845 from working. Also breaks other qcom SoC devices running postmarketOS.

Cc: stable <stable@kernel.org>
Cc: Ekansh Gupta <quic_ekangupt@quicinc.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reported-by: Joel Selvaraj <joelselvaraj.oss@gmail.com>
Link: https://lore.kernel.org/r/9a9f5646-a554-4b65-8122-d212bb665c81@umsystem.edu
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Fixes: bab2f5e8fd5d ("misc: fastrpc: Restrict untrusted app to attach to privileged PD")
Link: https://lore.kernel.org/r/20240815094920.8242-1-griffin@kroah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by Griffin Kroah-Hartman and committed by Greg Kroah-Hartman 9bb5e74b ccbde4b1

options
unified split
Changed files
+3 -22
drivers
misc
fastrpc.c
include
uapi
misc
fastrpc.h
+3 -19
drivers/misc/fastrpc.c
··· 2085 2085 return err; 2086 2086 } 2087 2087 2088 - static int is_attach_rejected(struct fastrpc_user *fl) 2089 - { 2090 - /* Check if the device node is non-secure */ 2091 - if (!fl->is_secure_dev) { 2092 - dev_dbg(&fl->cctx->rpdev->dev, "untrusted app trying to attach to privileged DSP PD\n"); 2093 - return -EACCES; 2094 - } 2095 - return 0; 2096 - } 2097 - 2098 2088 static long fastrpc_device_ioctl(struct file *file, unsigned int cmd, 2099 2089 unsigned long arg) 2100 2090 { ··· 2097 2107 err = fastrpc_invoke(fl, argp); 2098 2108 break; 2099 2109 case FASTRPC_IOCTL_INIT_ATTACH: 2100 - err = is_attach_rejected(fl); 2101 - if (!err) 2102 - err = fastrpc_init_attach(fl, ROOT_PD); 2110 + err = fastrpc_init_attach(fl, ROOT_PD); 2103 2111 break; 2104 2112 case FASTRPC_IOCTL_INIT_ATTACH_SNS: 2105 - err = is_attach_rejected(fl); 2106 - if (!err) 2107 - err = fastrpc_init_attach(fl, SENSORS_PD); 2113 + err = fastrpc_init_attach(fl, SENSORS_PD); 2108 2114 break; 2109 2115 case FASTRPC_IOCTL_INIT_CREATE_STATIC: 2110 - err = is_attach_rejected(fl); 2111 - if (!err) 2112 - err = fastrpc_init_create_static_process(fl, argp); 2116 + err = fastrpc_init_create_static_process(fl, argp); 2113 2117 break; 2114 2118 case FASTRPC_IOCTL_INIT_CREATE: 2115 2119 err = fastrpc_init_create_process(fl, argp);
-3
include/uapi/misc/fastrpc.h
··· 8 8 #define FASTRPC_IOCTL_ALLOC_DMA_BUFF _IOWR('R', 1, struct fastrpc_alloc_dma_buf) 9 9 #define FASTRPC_IOCTL_FREE_DMA_BUFF _IOWR('R', 2, __u32) 10 10 #define FASTRPC_IOCTL_INVOKE _IOWR('R', 3, struct fastrpc_invoke) 11 - /* This ioctl is only supported with secure device nodes */ 12 11 #define FASTRPC_IOCTL_INIT_ATTACH _IO('R', 4) 13 12 #define FASTRPC_IOCTL_INIT_CREATE _IOWR('R', 5, struct fastrpc_init_create) 14 13 #define FASTRPC_IOCTL_MMAP _IOWR('R', 6, struct fastrpc_req_mmap) 15 14 #define FASTRPC_IOCTL_MUNMAP _IOWR('R', 7, struct fastrpc_req_munmap) 16 - /* This ioctl is only supported with secure device nodes */ 17 15 #define FASTRPC_IOCTL_INIT_ATTACH_SNS _IO('R', 8) 18 - /* This ioctl is only supported with secure device nodes */ 19 16 #define FASTRPC_IOCTL_INIT_CREATE_STATIC _IOWR('R', 9, struct fastrpc_init_create_static) 20 17 #define FASTRPC_IOCTL_MEM_MAP _IOWR('R', 10, struct fastrpc_mem_map) 21 18 #define FASTRPC_IOCTL_MEM_UNMAP _IOWR('R', 11, struct fastrpc_mem_unmap)