mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-06-26 14:42:13 +00:00
e7b390d7e6
https://review.lineageos.org/q/topic:%22n-asb-2023-06%22 Signed-off-by: Tad <tad@spotco.us>
106 lines
4.3 KiB
Diff
106 lines
4.3 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Brian Delwiche <delwiche@google.com>
|
|
Date: Tue, 11 Oct 2022 21:23:22 +0000
|
|
Subject: [PATCH] Prevent use-after-free of HID reports
|
|
|
|
BTA sends the the HID report pointer to BTIF and deallocates it immediately.
|
|
This is now prevented by providing a deep copy callback function for HID
|
|
reports when tranferring context from BTA to BTIF.
|
|
|
|
This is a backport of change Icef7a7ed1185b4283ee4fe4f812ca154d8f1b825,
|
|
already merged on T for b/227620181.
|
|
|
|
Bug: 228837201
|
|
Test: Validated against researcher POC, ran BT unit tests, played audio
|
|
manually.
|
|
Tag: #security
|
|
Ignore-AOSP-First: Security
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:874c495c886cd8722625756dc5fd0634b16b4f42)
|
|
Merged-In: Ib837f395883de2369207f1b3b974d6bff02dcb19
|
|
Change-Id: Ib837f395883de2369207f1b3b974d6bff02dcb19
|
|
---
|
|
btif/src/btif_hh.c | 49 +++++++++++++++++++++++++++++++++++++++++++---
|
|
1 file changed, 46 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/btif/src/btif_hh.c b/btif/src/btif_hh.c
|
|
index a4057cca5..69e87b9f8 100644
|
|
--- a/btif/src/btif_hh.c
|
|
+++ b/btif/src/btif_hh.c
|
|
@@ -1093,6 +1093,38 @@ static void btif_hh_upstreams_evt(UINT16 event, char* p_param)
|
|
}
|
|
}
|
|
|
|
+/*******************************************************************************
|
|
+ *
|
|
+ * Function btif_hh_hsdata_rpt_copy_cb
|
|
+ *
|
|
+ * Description Deep copies the tBTA_HH_HSDATA structure
|
|
+ *
|
|
+ * Returns void
|
|
+ *
|
|
+ ******************************************************************************/
|
|
+
|
|
+static void btif_hh_hsdata_rpt_copy_cb(UINT16 event, char* p_dest,
|
|
+ char* p_src) {
|
|
+ tBTA_HH_HSDATA* p_dst_data = (tBTA_HH_HSDATA*)p_dest;
|
|
+ tBTA_HH_HSDATA* p_src_data = (tBTA_HH_HSDATA*)p_src;
|
|
+ BT_HDR* hdr;
|
|
+
|
|
+ if (!p_src) {
|
|
+ BTIF_TRACE_ERROR("%s: Nothing to copy", __func__);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ memcpy(p_dst_data, p_src_data, sizeof(tBTA_HH_HSDATA));
|
|
+
|
|
+ hdr = p_src_data->rsp_data.p_rpt_data;
|
|
+ if (hdr != NULL) {
|
|
+ UINT8* p_data = ((UINT8*)p_dst_data) + sizeof(tBTA_HH_HSDATA);
|
|
+ memcpy(p_data, hdr, BT_HDR_SIZE + hdr->offset + hdr->len);
|
|
+
|
|
+ p_dst_data->rsp_data.p_rpt_data = (BT_HDR*)p_data;
|
|
+ }
|
|
+}
|
|
+
|
|
/*******************************************************************************
|
|
**
|
|
** Function bte_hh_evt
|
|
@@ -1107,6 +1139,7 @@ static void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH *p_data)
|
|
{
|
|
bt_status_t status;
|
|
int param_len = 0;
|
|
+ tBTIF_COPY_CBACK* p_copy_cback = NULL;
|
|
|
|
if (BTA_HH_ENABLE_EVT == event)
|
|
param_len = sizeof(tBTA_HH_STATUS);
|
|
@@ -1118,16 +1151,26 @@ static void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH *p_data)
|
|
param_len = sizeof(tBTA_HH_CBDATA);
|
|
else if (BTA_HH_GET_DSCP_EVT == event)
|
|
param_len = sizeof(tBTA_HH_DEV_DSCP_INFO);
|
|
- else if ((BTA_HH_GET_PROTO_EVT == event) || (BTA_HH_GET_RPT_EVT == event)|| (BTA_HH_GET_IDLE_EVT == event))
|
|
+ else if ((BTA_HH_GET_PROTO_EVT == event) || (BTA_HH_GET_IDLE_EVT == event))
|
|
param_len = sizeof(tBTA_HH_HSDATA);
|
|
- else if ((BTA_HH_SET_PROTO_EVT == event) || (BTA_HH_SET_RPT_EVT == event) || (BTA_HH_VC_UNPLUG_EVT == event) || (BTA_HH_SET_IDLE_EVT == event))
|
|
+ else if (BTA_HH_GET_RPT_EVT == event) {
|
|
+ BT_HDR* hdr = p_data->hs_data.rsp_data.p_rpt_data;
|
|
+ param_len = sizeof(tBTA_HH_HSDATA);
|
|
+
|
|
+ if (hdr != NULL) {
|
|
+ p_copy_cback = btif_hh_hsdata_rpt_copy_cb;
|
|
+ param_len += BT_HDR_SIZE + hdr->offset + hdr->len;
|
|
+ }
|
|
+ } else if ((BTA_HH_SET_PROTO_EVT == event) || (BTA_HH_SET_RPT_EVT == event) ||
|
|
+ (BTA_HH_VC_UNPLUG_EVT == event) || (BTA_HH_SET_IDLE_EVT == event))
|
|
param_len = sizeof(tBTA_HH_CBDATA);
|
|
else if ((BTA_HH_ADD_DEV_EVT == event) || (BTA_HH_RMV_DEV_EVT == event) )
|
|
param_len = sizeof(tBTA_HH_DEV_INFO);
|
|
else if (BTA_HH_API_ERR_EVT == event)
|
|
param_len = 0;
|
|
/* switch context to btif task context (copy full union size for convenience) */
|
|
- status = btif_transfer_context(btif_hh_upstreams_evt, (uint16_t)event, (void*)p_data, param_len, NULL);
|
|
+ status = btif_transfer_context(btif_hh_upstreams_evt, (uint16_t)event,
|
|
+ (void*)p_data, param_len, p_copy_cback);
|
|
|
|
/* catch any failed context transfers */
|
|
ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
|