Information

The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module. This allows an attacker to bypass intended access restrictions by using the /ashmem string as the dentry name.

Patch

diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 808acd4..ee79ac8 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -766,11 +766,28 @@ static long compat_ashmem_ioctl(struct file *file, unsigned int cmd, unsigned lo
 }
 #endif
 
+static const struct file_operations ashmem_fops = {
+   .owner = THIS_MODULE,
+   .open = ashmem_open,
+   .release = ashmem_release,
+   .read = ashmem_read,
+   .llseek = ashmem_llseek,
+   .mmap = ashmem_mmap,
+   .unlocked_ioctl = ashmem_ioctl,
+#ifdef CONFIG_COMPAT
+   .compat_ioctl = compat_ashmem_ioctl,
+#endif
+};
+
+static struct miscdevice ashmem_misc = {
+   .minor = MISC_DYNAMIC_MINOR,
+   .name = "ashmem",
+   .fops = &ashmem_fops,
+};
+
 static int is_ashmem_file(struct file *file)
 {
-   char fname[256], *name;
-   name = dentry_path(file->f_dentry, fname, 256);
-   return strcmp(name, "/ashmem") ? 0 : 1;
+   return (file->f_op == &ashmem_fops);
 }
 
 int get_ashmem_file(int fd, struct file **filp, struct file **vm_file,
@@ -819,25 +836,6 @@ void put_ashmem_file(struct file *file)
 }
 EXPORT_SYMBOL(put_ashmem_file);
 
-static const struct file_operations ashmem_fops = {
-   .owner = THIS_MODULE,
-   .open = ashmem_open,
-   .release = ashmem_release,
-   .read = ashmem_read,
-   .llseek = ashmem_llseek,
-   .mmap = ashmem_mmap,
-   .unlocked_ioctl = ashmem_ioctl,
-#ifdef CONFIG_COMPAT
-   .compat_ioctl = compat_ashmem_ioctl,
-#endif
-};
-
-static struct miscdevice ashmem_misc = {
-   .minor = MISC_DYNAMIC_MINOR,
-   .name = "ashmem",
-   .fops = &ashmem_fops,
-};
-
 static int __init ashmem_init(void)
 {
    int ret;


References:
https://source.android.com/security/bulletin/2016-09-01
https://blog.checkpoint.com/2016/08/07/quadrooter/