jmb
/
hardened_malloc
mirror of https://github.com/GrapheneOS/hardened_malloc.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

temporary workaround for Pixel 3 camera UAF

PQ3A.190505.001.2019.05.08.15
Daniel Micay 2019-01-01 14:45:27 -05:00
parent b40ba9754b
commit 94c9baeb22
1 changed files with 22 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
h_malloc.c
View File

@ -74,6 +74,8 @@ static union {
int metadata_pkey; int metadata_pkey;
bool pkey_state_preserved_on_fork; bool pkey_state_preserved_on_fork;
#endif #endif
bool zero_on_free;
bool purge_slabs;
}; };
char padding[PAGE_SIZE]; char padding[PAGE_SIZE];
} ro __attribute__((aligned(PAGE_SIZE))); } ro __attribute__((aligned(PAGE_SIZE)));
@ -426,7 +428,7 @@ static void *slot_pointer(size_t size, void *slab, size_t slot) {
} }
static void write_after_free_check(const char *p, size_t size) { static void write_after_free_check(const char *p, size_t size) {
if (!WRITE_AFTER_FREE_CHECK) { if (!WRITE_AFTER_FREE_CHECK || !ro.zero_on_free) {
return; return;
} }
@ -668,7 +670,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
} }
} }
if (ZERO_ON_FREE) { if (ro.zero_on_free) {
memset(p, 0, size - canary_size); memset(p, 0, size - canary_size);
} }
} }
@ -745,7 +747,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
metadata->prev = NULL; metadata->prev = NULL;
if (c->empty_slabs_total + slab_size > max_empty_slabs_total) { if (c->empty_slabs_total + slab_size > max_empty_slabs_total) {
if (!memory_map_fixed(slab, slab_size)) { if (ro.purge_slabs && !memory_map_fixed(slab, slab_size)) {
label_slab(slab, slab_size, class); label_slab(slab, slab_size, class);
stats_slab_deallocate(c, slab_size); stats_slab_deallocate(c, slab_size);
enqueue_free_slab(c, metadata); enqueue_free_slab(c, metadata);
@ -1046,6 +1048,18 @@ static inline void enforce_init(void) {
} }
} }
COLD static void handle_camera_bug(void) {
const char expected[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
char path[sizeof(expected)];
if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
return;
}
if (strcmp(expected, path) == 0) {
ro.zero_on_free = false;
ro.purge_slabs = false;
}
}
COLD static void init_slow_path(void) { COLD static void init_slow_path(void) {
static struct mutex lock = MUTEX_INITIALIZER; static struct mutex lock = MUTEX_INITIALIZER;
@ -1069,6 +1083,10 @@ COLD static void init_slow_path(void) {
} }
#endif #endif
ro.purge_slabs = true;
ro.zero_on_free = ZERO_ON_FREE;
handle_camera_bug();
if (sysconf(_SC_PAGESIZE) != PAGE_SIZE) { if (sysconf(_SC_PAGESIZE) != PAGE_SIZE) {
fatal_error("page size mismatch"); fatal_error("page size mismatch");
} }
@ -1340,7 +1358,7 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
total_size = adjust_size_for_canaries(total_size); total_size = adjust_size_for_canaries(total_size);
void *p = allocate(arena, total_size); void *p = allocate(arena, total_size);
thread_seal_metadata(); thread_seal_metadata();
if (!ZERO_ON_FREE && likely(p != NULL) && total_size && total_size <= max_slab_size_class) { if (!ro.zero_on_free && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
memset(p, 0, total_size - canary_size); memset(p, 0, total_size - canary_size);
} }
return p; return p;