android/SukiSU-Ultra
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

kernel: align prctl harden commit from backslashxx/KernelSU

Browse Source 
SQUASHED:
* kernel: harden barriers for arm/arm64
* kernel: core_hook: harden prctl handler

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>
This commit is contained in:
backslashxx
2025-10-04 22:09:40 +07:00
committed by ShirkNeko
parent 1d4d23d2c9
commit 1f468f35f4
2 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
kernel/core_hook.c
View File

@@ -313,21 +313,29 @@ int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3,
u32 reply_ok = KERNEL_SU_OPTION;
uid_t current_uid_val = current_uid().val;
// we can skip this check when a manager is crowned already
if (likely(ksu_is_manager_uid_valid()))
goto skip;
// skip this private space support if uid below 100k
if (current_uid_val < 100000)
goto skip_check;
uid_t manager_uid = ksu_get_manager_uid();
if (current_uid_val != manager_uid &&
if (current_uid_val != manager_uid &&
current_uid_val % 100000 == manager_uid) {
ksu_set_manager_uid(current_uid_val);
ksu_set_manager_uid(current_uid_val);
}
skip:
skip_check:
// yes this causes delay, but this keeps the delay consistent, which is what we want
// with a barrier for safety as the compiler might try to do something smart.
kcompat_barrier();
if (!is_prctl_valid(option))
if (!is_allow_su())
return 0;
// we move it after uid check here so they cannot
// compare 0xdeadbeef call to a non-0xdeadbeef call
if (KERNEL_SU_OPTION != option)
return 0;
// just continue old logic
bool from_root = 0 == current_uid().val;
bool from_manager = is_manager();