Received-SPF: pass (google.com: domain of linux-kernel+bounces-198638-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <6c026f78-d397-4375-a347-85f41bff1e99@quicinc.com>
Date: Mon, 3 Jun 2024 11:57:52 +0530
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v3 8/9] misc: fastrpc: Restrict untrusted app to spawn
 signed PD
Content-Language: en-US
To: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
CC: <srinivas.kandagatla@linaro.org>, <linux-arm-msm@vger.kernel.org>,
        <gregkh@linuxfoundation.org>, <quic_bkumar@quicinc.com>,
        <linux-kernel@vger.kernel.org>, <quic_chennak@quicinc.com>,
        stable
	<stable@kernel.org>
References: <20240530102032.27179-1-quic_ekangupt@quicinc.com>
 <20240530102032.27179-9-quic_ekangupt@quicinc.com>
 <q6vl2d7ekrjiwbr4h6cieh6q7vewhbiqay67wrglurphkigq4c@zoeyzywhypww>
From: Ekansh Gupta <quic_ekangupt@quicinc.com>
In-Reply-To: <q6vl2d7ekrjiwbr4h6cieh6q7vewhbiqay67wrglurphkigq4c@zoeyzywhypww>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit


On 5/31/2024 5:19 AM, Dmitry Baryshkov wrote:
> On Thu, May 30, 2024 at 03:50:26PM +0530, Ekansh Gupta wrote:
>> Some untrusted applications will not have access to open fastrpc
>> device nodes and a privileged process can open the device node on
>> behalf of the application. Add a check to restrict such untrusted
>> applications from offloading to signed PD.
>>
>> Fixes: 7f1f481263c3 ("misc: fastrpc: check before loading process to the DSP")
>> Cc: stable <stable@kernel.org>
>> Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
>> ---
>>   drivers/misc/fastrpc.c | 23 ++++++++++++++++++-----
>>   1 file changed, 18 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
>> index 73fa0e536cf9..32615ccde7ac 100644
>> --- a/drivers/misc/fastrpc.c
>> +++ b/drivers/misc/fastrpc.c
>> @@ -328,6 +328,7 @@ struct fastrpc_user {
>>   	int pd;
>>   	bool is_secure_dev;
>>   	bool is_unsigned_pd;
>> +	bool untrusted_process;
>>   	char *servloc_name;
>>   	/* Lock for lists */
>>   	spinlock_t lock;
>> @@ -1249,13 +1250,17 @@ static bool is_session_rejected(struct fastrpc_user *fl, bool unsigned_pd_reques
>>   		 * channel is configured as secure and block untrusted apps on channel
>>   		 * that does not support unsigned PD offload
>>   		 */
>> -		if (!fl->cctx->unsigned_support || !unsigned_pd_request) {
>> -			dev_err(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD\n");
>> -			return true;
>> -		}
>> +		if (!fl->cctx->unsigned_support || !unsigned_pd_request)
>> +			goto reject_session;
>>   	}
>> +	/* Check if untrusted process is trying to offload to signed PD */
>> +	if (fl->untrusted_process && !unsigned_pd_request)
>> +		goto reject_session;
>>   
>>   	return false;
>> +reject_session:
>> +	dev_dbg(&fl->cctx->rpdev->dev, "Error: Untrusted application trying to offload to signed PD\n");
>> +	return true;
>>   }
>>   
>>   static void fastrpc_mmap_remove_pdr(struct fastrpc_static_pd *spd)
>> @@ -1504,12 +1509,20 @@ static int fastrpc_init_create_process(struct fastrpc_user *fl,
>>   		goto err;
>>   	}
>>   
>> +	/*
>> +	 * Third-party apps don't have permission to open the fastrpc device, so
> Permissions depend on the end-user setup. Is it going to break if the
> user sets 0666 mode for fastrpc nodes?

If the root user sets 0666 for fastrpc nodes, it is expected that this check will get bypassed.

>
>> +	 * it is opened on their behalf by a priveleged process. This is detected
>> +	 * by comparing current PID with the one stored during device open.
>> +	 */
>> +	if (current->tgid != fl->tgid)
>> +		fl->untrusted_process = true;
> If the comment talks about PIDs, when why are you comparing GIDs here?

It should be GID, I'll update the comment in next spin.

>
>> +
>>   	if (init.attrs & FASTRPC_MODE_UNSIGNED_MODULE)
>>   		fl->is_unsigned_pd = true;
>>   
>>   
>>   	if (is_session_rejected(fl, fl->is_unsigned_pd)) {
>> -		err = -ECONNREFUSED;
>> +		err = -EACCES;
>>   		goto err;
>>   	}
>>   
>> -- 
>> 2.43.0
>>