android/SukiSU-Ultra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

kernel: align prctl harden commit from backslashxx/KernelSU

Browse Source 
SQUASHED:
* kernel: harden barriers for arm/arm64
* kernel: core_hook: harden prctl handler

Signed-off-by: backslashxx <118538522+backslashxx@users.noreply.github.com>
Signed-off-by: rsuntk <rsuntk@yukiprjkt.my.id>
This commit is contained in:
backslashxx
2025-10-04 22:09:40 +07:00
committed by ShirkNeko
parent 1d4d23d2c9
commit 1f468f35f4
2 changed files with 19 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
kernel/core_hook.c
View File

@@ -313,21 +313,29 @@ int ksu_handle_prctl(int option, unsigned long arg2, unsigned long arg3,
u32 reply_ok = KERNEL_SU_OPTION; u32 reply_ok = KERNEL_SU_OPTION;
uid_t current_uid_val = current_uid().val; uid_t current_uid_val = current_uid().val;
// we can skip this check when a manager is crowned already // skip this private space support if uid below 100k
if (likely(ksu_is_manager_uid_valid())) if (current_uid_val < 100000)
goto skip; goto skip_check;
uid_t manager_uid = ksu_get_manager_uid(); uid_t manager_uid = ksu_get_manager_uid();
if (current_uid_val != manager_uid && if (current_uid_val != manager_uid &&
current_uid_val % 100000 == manager_uid) { current_uid_val % 100000 == manager_uid) {
ksu_set_manager_uid(current_uid_val); ksu_set_manager_uid(current_uid_val);
} }
skip: skip_check:
// yes this causes delay, but this keeps the delay consistent, which is what we want
// with a barrier for safety as the compiler might try to do something smart.
kcompat_barrier(); kcompat_barrier();
if (!is_prctl_valid(option)) if (!is_allow_su())
return 0; return 0;
// we move it after uid check here so they cannot
// compare 0xdeadbeef call to a non-0xdeadbeef call
if (KERNEL_SU_OPTION != option)
return 0;
// just continue old logic
bool from_root = 0 == current_uid().val; bool from_root = 0 == current_uid().val;
bool from_manager = is_manager(); bool from_manager = is_manager();

8
kernel/kernel_compat.h
View File

@@ -7,12 +7,10 @@
#include "ss/policydb.h" #include "ss/policydb.h"
#include "linux/key.h" #include "linux/key.h"
#if defined(CONFIG_X86) #if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
#define kcompat_barrier() barrier_nospec() #define kcompat_barrier() do { barrier(); isb(); } while (0)
#elif defined(CONFIG_ARM) || defined(CONFIG_ARM64)
#define kcompat_barrier() isb() // arch/arm64/include/asm/barrier.h
#else #else
#define kcompat_barrier() barrier() // well, compiler atleast. #define kcompat_barrier() barrier()
#endif #endif
/* /*