All of
 help / color / mirror / Atom feed
From: Dmitry Baryshkov <>
To: Arnd Bergmann <>,
	Greg Kroah-Hartman <>
	Srinivas Kandagatla <>,
	Jonathan Marek <>,
Subject: [PATCH v2] misc: fastrpc: restrict user apps from sending kernel RPC messages
Date: Fri, 12 Feb 2021 22:26:58 +0300	[thread overview]
Message-ID: <> (raw)

Verify that user applications are not using the kernel RPC message
handle to restrict them from directly attaching to guest OS on the
remote subsystem. This is a port of CVE-2019-2308 fix.

Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: Srinivas Kandagatla <>
Cc: Jonathan Marek <>
Signed-off-by: Dmitry Baryshkov <>

Changes since v1:
 - changed to dev_warn_ratelimited to prevent userspace from flooding
   kernel log

 drivers/misc/fastrpc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f12e909034ac..beda610e6b30 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -950,6 +950,11 @@ static int fastrpc_internal_invoke(struct fastrpc_user *fl,  u32 kernel,
 	if (!fl->cctx->rpdev)
 		return -EPIPE;
+	if (handle == FASTRPC_INIT_HANDLE && !kernel) {
+		dev_warn_ratelimited(fl->sctx->dev, "user app trying to send a kernel RPC message (%d)\n",  handle);
+		return -EPERM;
+	}
 	ctx = fastrpc_context_alloc(fl, kernel, sc, args);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);

             reply	other threads:[~2021-02-12 19:27 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-02-12 19:26 Dmitry Baryshkov [this message]
2021-02-13  8:25 ` [PATCH v2] misc: fastrpc: restrict user apps from sending kernel RPC messages Greg Kroah-Hartman
2021-03-01 15:34   ` Dmitry Baryshkov
2021-03-01 15:48     ` Greg Kroah-Hartman
2021-03-01 17:45       ` Dmitry Baryshkov
2021-03-01 18:50         ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.