110 lines
4.4 KiB
Diff
110 lines
4.4 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Brian Delwiche <delwiche@google.com>
|
|
Date: Tue, 11 Oct 2022 21:23:22 +0000
|
|
Subject: [PATCH] Prevent use-after-free of HID reports
|
|
|
|
BTA sends the the HID report pointer to BTIF and deallocates it immediately.
|
|
This is now prevented by providing a deep copy callback function for HID
|
|
reports when tranferring context from BTA to BTIF.
|
|
|
|
This is a backport of change Icef7a7ed1185b4283ee4fe4f812ca154d8f1b825,
|
|
already merged on T for b/227620181.
|
|
|
|
Bug: 228837201
|
|
Test: Validated against researcher POC, ran BT unit tests, played audio
|
|
manually.
|
|
Tag: #security
|
|
Ignore-AOSP-First: Security
|
|
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:874c495c886cd8722625756dc5fd0634b16b4f42)
|
|
Merged-In: Ib837f395883de2369207f1b3b974d6bff02dcb19
|
|
Change-Id: Ib837f395883de2369207f1b3b974d6bff02dcb19
|
|
|
|
Change-Id: I7e94dbdf4990ce8ebb03d8ffdacd4049f16873bb
|
|
---
|
|
btif/src/btif_hh.cc | 50 ++++++++++++++++++++++++++++++++++++++++-----
|
|
1 file changed, 45 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/btif/src/btif_hh.cc b/btif/src/btif_hh.cc
|
|
index 1b770ddb1..b5135ff2f 100644
|
|
--- a/btif/src/btif_hh.cc
|
|
+++ b/btif/src/btif_hh.cc
|
|
@@ -1127,6 +1127,38 @@ static void btif_hh_upstreams_evt(uint16_t event, char* p_param) {
|
|
}
|
|
}
|
|
|
|
+/*******************************************************************************
|
|
+ *
|
|
+ * Function btif_hh_hsdata_rpt_copy_cb
|
|
+ *
|
|
+ * Description Deep copies the tBTA_HH_HSDATA structure
|
|
+ *
|
|
+ * Returns void
|
|
+ *
|
|
+ ******************************************************************************/
|
|
+
|
|
+static void btif_hh_hsdata_rpt_copy_cb(uint16_t event, char* p_dest,
|
|
+ char* p_src) {
|
|
+ tBTA_HH_HSDATA* p_dst_data = (tBTA_HH_HSDATA*)p_dest;
|
|
+ tBTA_HH_HSDATA* p_src_data = (tBTA_HH_HSDATA*)p_src;
|
|
+ BT_HDR* hdr;
|
|
+
|
|
+ if (!p_src) {
|
|
+ BTIF_TRACE_ERROR("%s: Nothing to copy", __func__);
|
|
+ return;
|
|
+ }
|
|
+
|
|
+ memcpy(p_dst_data, p_src_data, sizeof(tBTA_HH_HSDATA));
|
|
+
|
|
+ hdr = p_src_data->rsp_data.p_rpt_data;
|
|
+ if (hdr != NULL) {
|
|
+ uint8_t* p_data = ((uint8_t*)p_dst_data) + sizeof(tBTA_HH_HSDATA);
|
|
+ memcpy(p_data, hdr, BT_HDR_SIZE + hdr->offset + hdr->len);
|
|
+
|
|
+ p_dst_data->rsp_data.p_rpt_data = (BT_HDR*)p_data;
|
|
+ }
|
|
+}
|
|
+
|
|
/*******************************************************************************
|
|
*
|
|
* Function bte_hh_evt
|
|
@@ -1140,6 +1172,7 @@ static void btif_hh_upstreams_evt(uint16_t event, char* p_param) {
|
|
void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH* p_data) {
|
|
bt_status_t status;
|
|
int param_len = 0;
|
|
+ tBTIF_COPY_CBACK* p_copy_cback = NULL;
|
|
|
|
if (BTA_HH_ENABLE_EVT == event)
|
|
param_len = sizeof(tBTA_HH_STATUS);
|
|
@@ -1151,11 +1184,18 @@ void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH* p_data) {
|
|
param_len = sizeof(tBTA_HH_CBDATA);
|
|
else if (BTA_HH_GET_DSCP_EVT == event)
|
|
param_len = sizeof(tBTA_HH_DEV_HANDLE_DSCP_INFO);
|
|
- else if ((BTA_HH_GET_PROTO_EVT == event) || (BTA_HH_GET_RPT_EVT == event) ||
|
|
- (BTA_HH_GET_IDLE_EVT == event))
|
|
+ else if ((BTA_HH_GET_PROTO_EVT == event) || (BTA_HH_GET_IDLE_EVT == event))
|
|
+ param_len = sizeof(tBTA_HH_HSDATA);
|
|
+ else if (BTA_HH_GET_RPT_EVT == event) {
|
|
+ BT_HDR* hdr = p_data->hs_data.rsp_data.p_rpt_data;
|
|
param_len = sizeof(tBTA_HH_HSDATA);
|
|
- else if ((BTA_HH_SET_PROTO_EVT == event) || (BTA_HH_SET_RPT_EVT == event) ||
|
|
- (BTA_HH_VC_UNPLUG_EVT == event) || (BTA_HH_SET_IDLE_EVT == event))
|
|
+
|
|
+ if (hdr != NULL) {
|
|
+ p_copy_cback = btif_hh_hsdata_rpt_copy_cb;
|
|
+ param_len += BT_HDR_SIZE + hdr->offset + hdr->len;
|
|
+ }
|
|
+ } else if ((BTA_HH_SET_PROTO_EVT == event) || (BTA_HH_SET_RPT_EVT == event) ||
|
|
+ (BTA_HH_VC_UNPLUG_EVT == event) || (BTA_HH_SET_IDLE_EVT == event))
|
|
param_len = sizeof(tBTA_HH_CBDATA);
|
|
else if ((BTA_HH_ADD_DEV_EVT == event) || (BTA_HH_RMV_DEV_EVT == event))
|
|
param_len = sizeof(tBTA_HH_DEV_INFO);
|
|
@@ -1164,7 +1204,7 @@ void bte_hh_evt(tBTA_HH_EVT event, tBTA_HH* p_data) {
|
|
/* switch context to btif task context (copy full union size for convenience)
|
|
*/
|
|
status = btif_transfer_context(btif_hh_upstreams_evt, (uint16_t)event,
|
|
- (char*)p_data, param_len, NULL);
|
|
+ (char*)p_data, param_len, p_copy_cback);
|
|
|
|
/* catch any failed context transfers */
|
|
ASSERTC(status == BT_STATUS_SUCCESS, "context transfer failed", status);
|