evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

staging: android: ion: fix ION_IOC_IMPORT use-after-free

Browse source 
The use-after-free issue can also occur with ION_IOC_IMPORT
just like in the commit 2c155709e4
("staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free").
This is due to reacquiring client->lock in pass_to_user().

Change-Id: Ib5f3297504763c341b3ce343ef18538ce2c9c7d5
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>
This commit is contained in:
Srinivasarao P 2018-10-29 16:44:50 +05:30
parent f1587d8660
commit f2b44c5c18
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/staging/android/ion/ion.c
View file

@ -453,16 +453,14 @@ static struct ion_handle *user_ion_handle_get_check_overflow(
/* passes a kref to the user ref count. /* passes a kref to the user ref count.
* We know we're holding a kref to the object before and * We know we're holding a kref to the object before and
* after this call, so no need to reverify handle. * after this call, so no need to reverify handle.
* Caller must hold the client lock, except for ION_IOC_ALLOC.
*/ */
static struct ion_handle *pass_to_user(struct ion_handle *handle) static struct ion_handle *pass_to_user(struct ion_handle *handle)
{ {
struct ion_client *client = handle->client;
struct ion_handle *ret; struct ion_handle *ret;
mutex_lock(&client->lock);
ret = user_ion_handle_get_check_overflow(handle); ret = user_ion_handle_get_check_overflow(handle);
ion_handle_put_nolock(handle); ion_handle_put_nolock(handle);
mutex_unlock(&client->lock);
return ret; return ret;
} }
@ -1700,7 +1698,8 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
{ {
struct ion_handle *handle; struct ion_handle *handle;
handle = ion_import_dma_buf(client, data.fd.fd); mutex_lock(&client->lock);
handle = ion_import_dma_buf_nolock(client, data.fd.fd);
if (IS_ERR(handle)) { if (IS_ERR(handle)) {
ret = PTR_ERR(handle); ret = PTR_ERR(handle);
} else { } else {
@ -1710,6 +1709,7 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
else else
data.handle.handle = handle->id; data.handle.handle = handle->id;
} }
mutex_unlock(&client->lock);
break; break;
} }
case ION_IOC_SYNC: case ION_IOC_SYNC: