Git-Mirrors/DivestOS
1
0
Fork 0
mirror of https://github.com/Divested-Mobile/DivestOS-Build.git synced 2025-08-18 19:08:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

hardened_malloc fixes for broken devices

Browse source 
- enable the patchset for 18.1
- add an ugly patch that extends the Pixel 3* camera workaround to all camera executables

Signed-off-by: Tad <tad@spotco.us>
This commit is contained in:
Tad 2022-03-15 22:22:32 -04:00
parent e002154486
commit a9f6672fed
11 changed files with 168 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

66
Patches/LineageOS-16.0/android_external_hardened_malloc/0001-Broken_Audio.patch Normal file
View file

@ -0,0 +1,66 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Daniel Micay <danielmicay@gmail.com>
Date: Thu, 28 May 2020 20:19:14 -0400
Subject: [PATCH] workaround for audio service sorting bug
---
h_malloc.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/h_malloc.c b/h_malloc.c
index 8d15ab2..dbedbd4 100644
--- a/h_malloc.c
+++ b/h_malloc.c
@@ -85,6 +85,7 @@ static union {
bool zero_on_free;
bool purge_slabs;
bool region_quarantine_protect;
+ bool slot_randomize;
};
char padding[PAGE_SIZE];
} ro __attribute__((aligned(PAGE_SIZE)));
@@ -355,7 +356,7 @@ static u64 get_mask(size_t slots) {
}
static size_t get_free_slot(struct random_state *rng, size_t slots, struct slab_metadata *metadata) {
- if (SLOT_RANDOMIZE) {
+ if (ro.slot_randomize) {
// randomize start location for linear search (uniform random choice is too slow)
unsigned random_index = get_random_u16_uniform(rng, slots);
unsigned first_bitmap = random_index / 64;
@@ -1061,17 +1062,24 @@ static inline void enforce_init(void) {
}
}
-COLD static void handle_hal_bugs(void) {
+COLD static void handle_bugs(void) {
char path[256];
if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
return;
}
+
const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
if (strcmp(camera_provider, path) == 0) {
ro.zero_on_free = false;
ro.purge_slabs = false;
ro.region_quarantine_protect = false;
}
+
+ // DeviceDescriptor sorting wrongly relies on malloc addresses
+ const char audio_service[] = "/system/bin/audioserver";
+ if (strcmp(audio_service, path) == 0) {
+ ro.slot_randomize = false;
+ }
}
COLD static void init_slow_path(void) {
@@ -1100,7 +1108,8 @@ COLD static void init_slow_path(void) {
ro.purge_slabs = true;
ro.zero_on_free = ZERO_ON_FREE;
ro.region_quarantine_protect = true;
- handle_hal_bugs();
+ ro.slot_randomize = SLOT_RANDOMIZE;
+ handle_bugs();
if (sysconf(_SC_PAGESIZE) != PAGE_SIZE) {
fatal_error("page size mismatch");

25
Patches/LineageOS-16.0/android_external_hardened_malloc/0002-Broken_Cameras.patch Normal file
View file

@ -0,0 +1,25 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Tad <tad@spotco.us>
Date: Tue, 15 Mar 2022 22:18:26 -0400
Subject: [PATCH] Expand workaround to all camera executables
Signed-off-by: Tad <tad@spotco.us>
---
h_malloc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/h_malloc.c b/h_malloc.c
index dbedbd4..ebf5d76 100644
--- a/h_malloc.c
+++ b/h_malloc.c
@@ -1068,8 +1068,8 @@ COLD static void handle_bugs(void) {
return;
}
- const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
- if (strcmp(camera_provider, path) == 0) {
+ // Any camera executable on system partition
+ if (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0)) {
ro.zero_on_free = false;
ro.purge_slabs = false;
ro.region_quarantine_protect = false;

0
Patches/Common/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch → Patches/LineageOS-16.0/android_frameworks_av/0001-HM-No_RLIMIT_AS.patch
View file

25
Patches/LineageOS-17.1/android_external_hardened_malloc/0001-Broken_Cameras.patch Normal file
View file

@ -0,0 +1,25 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Tad <tad@spotco.us>
Date: Tue, 15 Mar 2022 22:18:26 -0400
Subject: [PATCH] Expand workaround to all camera executables
Signed-off-by: Tad <tad@spotco.us>
---
h_malloc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/h_malloc.c b/h_malloc.c
index de693c9..95a6ba3 100644
--- a/h_malloc.c
+++ b/h_malloc.c
@@ -1057,8 +1057,8 @@ COLD static void handle_bugs(void) {
return;
}
- const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
- if (strcmp(camera_provider, path) == 0) {
+ // Any camera executable on system partition
+ if (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0)) {
ro.zero_on_free = false;
ro.purge_slabs = false;
ro.region_quarantine_protect = false;

38
Patches/LineageOS-17.1/android_frameworks_av/0001-HM_A2DP_Fix.patch
View file

@ -1,38 +0,0 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Oscar Mira <valldrac@pm.me>
Date: Sun, 10 May 2020 01:56:34 +0200
Subject: [PATCH] Fix AudioPolicy device entries order to support
SLOT_RANDOMIZE
Fix GrapheneOS/os_issue_tracker#137
---
.../include/DeviceDescriptor.h | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h b/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h
index 33e506f1b7..5f9f8b558c 100644
--- a/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h
+++ b/services/audiopolicy/common/managerdefinitions/include/DeviceDescriptor.h
@@ -206,6 +206,22 @@ public:
void dump(String8 *dst, const String8 &tag, int spaces = 0, bool verbose = true) const;
+protected:
+ // Sorts devices by type.
+ int do_compare(const void* lhs, const void* rhs) const override
+ {
+ const auto& l = *reinterpret_cast<const sp<DeviceDescriptor>*>(lhs);
+ const auto& r = *reinterpret_cast<const sp<DeviceDescriptor>*>(rhs);
+
+ audio_devices_t lt = l->type();
+ audio_devices_t rt = r->type();
+
+ if (lt == rt) {
+ return 0;
+ }
+ return lt > rt ? 1 : -1;
+ }
+
private:
void refreshTypes();
audio_devices_t mDeviceTypes;

26
Patches/LineageOS-18.1/android_external_hardened_malloc/0001-Broken_Cameras.patch Normal file
View file

@ -0,0 +1,26 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Tad <tad@spotco.us>
Date: Tue, 15 Mar 2022 22:18:26 -0400
Subject: [PATCH] Expand workaround to all camera executables
Signed-off-by: Tad <tad@spotco.us>
---
h_malloc.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/h_malloc.c b/h_malloc.c
index a6e1a7c..662af35 100644
--- a/h_malloc.c
+++ b/h_malloc.c
@@ -1068,9 +1068,8 @@ COLD static void handle_bugs(void) {
return;
}
- // Pixel 3, Pixel 3 XL, Pixel 3a and Pixel 3a XL camera provider
- const char camera_provider[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
- if (strcmp(camera_provider, path) == 0) {
+ // Any camera executable on system partition
+ if (strstr(path, "camera") != NULL && (strncmp("/system", path, 7) == 0 || strncmp("/vendor", path, 7) == 0)) {
ro.zero_on_free = false;
ro.purge_slabs = false;
ro.region_quarantine_protect = false;