Replace tbm_key by tbm_fd for buffer protection

- Any other process can access buffer if it knows its tbm_key,
  but, there is no way to access if it's replaced by tbm_fd.

[Version] 0.3.15
[Profile] Common
[Issue Type] Update
[Dependency module] mmsvc-camera, capi-media-recorder

Change-Id: Iad10f26e000ef35c278561b04f471a8711dcc517
Signed-off-by: Jeongmo Yang <jm80.yang@samsung.com>

diff --git a/muse/include/muse_recorder_msg.h b/muse/include/muse_recorder_msg.h
index 08be928880c6ec940d22d2d30a849b39cf73fe36..b63cc4ff827f5b5c08b0221d05dcbfe39c608111 100644 (file)
--- a/muse/include/muse_recorder_msg.h
+++ b/muse/include/muse_recorder_msg.h
@@ -313,6 +313,39 @@ typedef const char* STRING;
                muse_core_msg_free(__sndMsg__); \
        } while (0)
 
+/**
+ * @brief Returning the event ack message from the server to client side, adding 2 parameters.
+ * @param[in] api The enumeration of the corresponding api.
+ * @param[in] event The enumeration of the event.
+ * @param[in] class The enumeration of the event class.
+ * @param[in] module The module info for the ipc transportation.
+ * @param[in] param1 The 1st parameter to be included in the message.
+ * @param[in] type2 The data type of the parameter.
+ * @param[in] param2 The 2nd parameter to be included in the message.
+ * @param[in] type3 The data type of the parameter.
+ * @param[in] param3 The 3rd parameter to be included in the message.
+ * @param[in] tfd The tbm fds to be delivered through the socket.
+ */
+#define muse_recorder_msg_event3_fd(api, event, class, module, type1, param1, type2, param2, type3, param3, tfd) \
+       do {    \
+               char *__sndMsg__; \
+               int __len__; \
+               type1 __value1__ = (type1)param1; \
+               type2 __value2__ = (type2)param2; \
+               type3 __value3__ = (type3)param3; \
+               __sndMsg__ = muse_core_msg_new(api, \
+                       MUSE_TYPE_INT, PARAM_EVENT, event, \
+                       MUSE_TYPE_INT, PARAM_EVENT_CLASS, class, \
+                       MUSE_TYPE_##type1, #param1, __value1__, \
+                       MUSE_TYPE_##type2, #param2, __value2__, \
+                       MUSE_TYPE_##type3, #param3, __value3__, \
+                       0); \
+               __len__ = muse_core_msg_send_fd(muse_server_module_get_msg_fd(module), (int *)tfd, __sndMsg__); \
+               if (__len__ <= 0) \
+                       LOGE("sending message failed [%d]", __len__); \
+               muse_core_msg_free(__sndMsg__); \
+       } while (0)
+
 /**
  * @brief Returning the event ack message from the server to client side, adding 3 parameters.
  * @param[in] api The enumeration of the corresponding api.
@@ -360,8 +393,9 @@ typedef const char* STRING;
  * @param[in] param4 The 4th parameter to be included in the message.
  * @param[in] type5 The data type of the parameter.
  * @param[in] param5 The 5th parameter to be included in the message.
+ * @param[in] tfd The tbm fds.
  */
-#define muse_recorder_msg_event5(api, event, class, module, type1, param1, type2, param2, type3, param3, type4, param4, type5, param5) \
+#define muse_recorder_msg_event5_fd(api, event, class, module, type1, param1, type2, param2, type3, param3, type4, param4, type5, param5, tfd) \
        do {    \
                char *__sndMsg__; \
                int __len__; \
@@ -369,7 +403,7 @@ typedef const char* STRING;
                type2 __value2__ = (type2)param2; \
                type3 __value3__ = (type3)param3; \
                type4 __value4__ = (type4)param4; \
-               type5 __value5__ = (type5)param5; \
+               type5 __value5__ = (type4)param5; \
                __sndMsg__ = muse_core_msg_new(api, \
                        MUSE_TYPE_INT, PARAM_EVENT, event, \
                        MUSE_TYPE_INT, PARAM_EVENT_CLASS, class, \
@@ -379,7 +413,7 @@ typedef const char* STRING;
                        MUSE_TYPE_##type4, #param4, __value4__, \
                        MUSE_TYPE_##type5, #param5, __value5__, \
                        0); \
-               __len__ = muse_core_msg_send(muse_server_module_get_msg_fd(module), __sndMsg__); \
+               __len__ = muse_core_msg_send_fd(muse_server_module_get_msg_fd(module), (int *)tfd, __sndMsg__); \
                if (__len__ <= 0) \
                        LOGE("sending message failed [%d]", __len__); \
                muse_core_msg_free(__sndMsg__); \

diff --git a/muse/src/muse_recorder_dispatcher.c b/muse/src/muse_recorder_dispatcher.c
index c2e0440ab7ef7b74415330581ee307a5a8b1e4d7..8392b0bab454cd492f9b683a2d1b7f2f66dff3fb 100644 (file)
--- a/muse/src/muse_recorder_dispatcher.c
+++ b/muse/src/muse_recorder_dispatcher.c
@@ -51,7 +51,7 @@ static GMutex g_recorder_device_state_lock;
  */
 typedef struct {
        tbm_bo bo;
-       int key;
+       tbm_fd fd;
 } muse_recorder_export_data;
 
 /**
@@ -266,7 +266,8 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
        muse_module_h module = (muse_module_h)user_data;
        muse_recorder_handle_s *muse_recorder = NULL;
        muse_recorder_export_data *export_data = NULL;
-       int tbm_key = 0;
+       int audio_fd = -1;
+       tbm_fd tfd[MUSE_NUM_FD] = {-1, -1, -1, -1};
        tbm_bo bo = NULL;
        tbm_bo_handle bo_handle = {.ptr = NULL};
 
@@ -293,36 +294,28 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
        bo = tbm_bo_alloc(muse_recorder->bufmgr, size, TBM_BO_DEFAULT);
        if (bo == NULL) {
                LOGE("bo alloc failed : bufmgr %p, size %d", muse_recorder->bufmgr, size);
-               g_free(export_data);
-               export_data = NULL;
-               return;
+               goto _BUFFER_FAILED;
        }
 
        bo_handle = tbm_bo_map(bo, TBM_DEVICE_CPU, TBM_OPTION_READ | TBM_OPTION_WRITE);
        if (bo_handle.ptr == NULL) {
                LOGE("bo map Error!");
-               tbm_bo_unref(bo);
-               g_free(export_data);
-               export_data = NULL;
-               return;
+               goto _BUFFER_FAILED;
        }
 
        memcpy(bo_handle.ptr, stream, size);
 
        tbm_bo_unmap(bo);
 
-       tbm_key = tbm_bo_export(bo);
-       if (tbm_key == 0) {
-               LOGE("Create key_info ERROR!!");
-               tbm_bo_unref(bo);
-               bo = NULL;
-               g_free(export_data);
-               export_data = NULL;
-               return;
+       audio_fd = tbm_bo_export_fd(bo);
+       if (audio_fd < 0) {
+               LOGE("export bo ERROR");
+               goto _BUFFER_FAILED;
        }
 
        /* set bo info */
-       export_data->key = tbm_key;
+       tfd[0] = audio_fd;
+       export_data->fd = audio_fd;
        export_data->bo = bo;
 
        /* add bo info to list */
@@ -331,7 +324,7 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
        g_mutex_unlock(&muse_recorder->list_lock);
 
        /* send message */
-       muse_recorder_msg_event5(MUSE_RECORDER_CB_EVENT,
+       muse_recorder_msg_event5_fd(MUSE_RECORDER_CB_EVENT,
                MUSE_RECORDER_EVENT_TYPE_AUDIO_STREAM,
                MUSE_RECORDER_EVENT_CLASS_THREAD_SUB,
                module,
@@ -339,9 +332,15 @@ void _recorder_disp_audio_stream_cb(void* stream, int size, recorder_sample_type
                INT, format,
                INT, channel,
                INT, timestamp,
-               INT, tbm_key);
+               INT, audio_fd,
+               tfd);
 
        return;
+
+_BUFFER_FAILED:
+       tbm_bo_unref(bo);
+       g_free(export_data);
+       return;
 }
 
 void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long offset, void *user_data)
@@ -349,7 +348,8 @@ void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long o
        muse_module_h module = (muse_module_h)user_data;
        muse_recorder_handle_s *muse_recorder = NULL;
        muse_recorder_export_data *export_data = NULL;
-       int tbm_key = 0;
+       int muxed_fd = -1;
+       tbm_fd tfd[MUSE_NUM_FD] = {-1, -1, -1, -1};
        tbm_bo bo = NULL;
        tbm_bo_handle bo_handle = {.ptr = NULL};
 
@@ -389,14 +389,15 @@ void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long o
 
        tbm_bo_unmap(bo);
 
-       tbm_key = tbm_bo_export(bo);
-       if (tbm_key == 0) {
-               LOGE("Create key_info ERROR!!");
+       muxed_fd = tbm_bo_export_fd(bo);
+       if (muxed_fd < 0) {
+               LOGE("export bo ERROR");
                goto _MUXED_STREAM_CB_ERROR;
        }
 
        /* set bo info */
-       export_data->key = tbm_key;
+       tfd[0] = muxed_fd;
+       export_data->fd = muxed_fd;
        export_data->bo = bo;
 
        /* add bo info to list */
@@ -405,13 +406,14 @@ void _recorder_disp_muxed_stream_cb(void* stream, int size, unsigned long long o
        g_mutex_unlock(&muse_recorder->list_lock);
 
        /* send message */
-       muse_recorder_msg_event3(MUSE_RECORDER_CB_EVENT,
+       muse_recorder_msg_event3_fd(MUSE_RECORDER_CB_EVENT,
                MUSE_RECORDER_EVENT_TYPE_MUXED_STREAM,
                MUSE_RECORDER_EVENT_CLASS_THREAD_SUB,
                module,
                INT, size,
-               INT, tbm_key,
-               INT64, offset);
+               INT64, offset,
+               INT, muxed_fd,
+               tfd);
 
        return;
 
@@ -502,14 +504,14 @@ bool _recorder_disp_foreach_supported_video_encoder_cb(recorder_video_codec_e co
        return true;
 }
 
-static int _recorder_remove_export_data(muse_module_h module, int key, int remove_all)
+static int _recorder_remove_export_data(muse_module_h module, tbm_fd fd, int remove_all)
 {
        muse_recorder_handle_s *muse_recorder = NULL;
        GList *tmp_list = NULL;
        muse_recorder_export_data *export_data = NULL;
 
-       if (module == NULL || (key <= 0 && remove_all == FALSE)) {
-               LOGE("invalid parameter %p, %d", module, key);
+       if (module == NULL || (fd < 0 && remove_all == FALSE)) {
+               LOGE("invalid parameter %p, %d", module, fd);
                return FALSE;
        }
 
@@ -526,16 +528,19 @@ static int _recorder_remove_export_data(muse_module_h module, int key, int remov
        while (tmp_list) {
                export_data = (muse_recorder_export_data *)tmp_list->data;
                if (export_data) {
-                       if (export_data->key == key || remove_all) {
-                               /*LOGD("key %d matched, remove it (remove_all %d)", key, remove_all);*/
+                       if (export_data->fd == fd || remove_all) {
+                               /*LOGD("fd %d matched, remove it (remove_all %d)", fd, remove_all);*/
 
                                if (export_data->bo) {
                                        tbm_bo_unref(export_data->bo);
                                        export_data->bo = NULL;
                                } else {
-                                       LOGW("bo for key %d is NULL", key);
+                                       LOGW("bo for fd %d is NULL", fd);
                                }
-                               export_data->key = 0;
+
+                               /* close exported fd */
+                               close(export_data->fd);
+                               export_data->fd = -1;
 
                                muse_recorder->data_list = g_list_remove(muse_recorder->data_list, export_data);
 
@@ -543,7 +548,7 @@ static int _recorder_remove_export_data(muse_module_h module, int key, int remov
                                export_data = NULL;
 
                                if (remove_all == FALSE) {
-                                       /*LOGD("key %d, remove done");*/
+                                       /*LOGD("fd %d, remove done", fd);*/
                                        g_mutex_unlock(&muse_recorder->list_lock);
                                        return TRUE;
                                } else {
@@ -562,7 +567,7 @@ static int _recorder_remove_export_data(muse_module_h module, int key, int remov
        if (remove_all)
                LOGD("remove all done");
        else
-               LOGE("should not be reached here - key %d", key);
+               LOGE("should not be reached here - fd %d", fd);
 
        return FALSE;
 }
@@ -2227,7 +2232,7 @@ int recorder_dispatcher_attr_set_root_directory(muse_module_h module)
 
 int recorder_dispatcher_return_buffer(muse_module_h module)
 {
-       int tbm_key = 0;
+       int ret_fd = -1;
        muse_recorder_handle_s *muse_recorder = NULL;
 
        muse_recorder = (muse_recorder_handle_s *)muse_server_ipc_get_handle(module);
@@ -2236,12 +2241,12 @@ int recorder_dispatcher_return_buffer(muse_module_h module)
                return MUSE_RECORDER_ERROR_NONE;
        }
 
-       muse_recorder_msg_get(tbm_key, muse_server_module_get_msg(module));
+       muse_recorder_msg_get(ret_fd, muse_server_module_get_msg(module));
 
-       /*LOGD("handle : %p, key : %d", muse_recorder, tbm_key);*/
+       /*LOGD("handle : %p, ret_fd : %d", muse_recorder, ret_fd);*/
 
-       if (!_recorder_remove_export_data(module, tbm_key, FALSE))
-               LOGE("remove export data failed : key %d", tbm_key);
+       if (!_recorder_remove_export_data(module, (tbm_fd)ret_fd, FALSE))
+               LOGE("remove export data failed : fd %d", ret_fd);
 
        return MUSE_RECORDER_ERROR_NONE;
 }
@@ -2489,7 +2494,7 @@ static int recorder_cmd_dispatcher_shutdown(muse_module_h module)
 
        legacy_recorder_get_state(muse_recorder->recorder_handle, &state);
 
-       LOGW("current state : %d", state);
+       LOGW("shutdown handle %p [state:%d]", muse_recorder->recorder_handle, state);
 
        switch (state) {
        case RECORDER_STATE_PAUSED:
@@ -2515,8 +2520,7 @@ static int recorder_cmd_dispatcher_shutdown(muse_module_h module)
                        free(muse_recorder);
                        muse_recorder = NULL;
                } else {
-                       LOGE("shutdown failed for handle %p %p",
-                               muse_recorder, muse_recorder->recorder_handle);
+                       LOGE("shutdown failed");
                }
                break;
        default:

diff --git a/packaging/mmsvc-recorder.spec b/packaging/mmsvc-recorder.spec
index 6c38fb79c76f1f60d10ef4d3372a24f124d2291f..20d3df170bf3234338d07894283427ab1a86a1ef 100644 (file)
--- a/packaging/mmsvc-recorder.spec
+++ b/packaging/mmsvc-recorder.spec
@@ -1,6 +1,6 @@
 Name:       mmsvc-recorder
 Summary:    A Recorder module for muse server
-Version:    0.3.14
+Version:    0.3.15
 Release:    0
 Group:      Multimedia/Libraries
 License:    Apache-2.0