evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ANDROID: ion: check for kref overflow

Browse source 
Userspace can cause the kref to handles to increment
arbitrarily high. Ensure it does not overflow.

Signed-off-by: Daniel Rosenberg <drosen@google.com>

Bug: 31992382
Test: See bug for poc
Change-Id: I6bff1df385742b1d836d43180dc87fadcea80782
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 0c702db4d90de88df11057bcf0d8fb2dfe741605
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
This commit is contained in:
Daniel Rosenberg 2016-12-05 16:28:28 -08:00 • committed by Gerrit - the friendly Code Review server
parent 92124c76a2
commit f6c025297e
1 changed files with 13 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/staging/android/ion/ion.c
View file

@ -16,6 +16,7 @@
* *
*/ */
#include <linux/atomic.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/file.h> #include <linux/file.h>
#include <linux/freezer.h> #include <linux/freezer.h>
@ -402,6 +403,15 @@ static void ion_handle_get(struct ion_handle *handle)
kref_get(&handle->ref); kref_get(&handle->ref);
} }
/* Must hold the client lock */
static struct ion_handle* ion_handle_get_check_overflow(struct ion_handle *handle)
{
if (atomic_read(&handle->ref.refcount) + 1 == 0)
return ERR_PTR(-EOVERFLOW);
ion_handle_get(handle);
return handle;
}
static int ion_handle_put_nolock(struct ion_handle *handle) static int ion_handle_put_nolock(struct ion_handle *handle)
{ {
int ret; int ret;
@ -448,9 +458,9 @@ static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
handle = idr_find(&client->idr, id); handle = idr_find(&client->idr, id);
if (handle) if (handle)
ion_handle_get(handle); return ion_handle_get_check_overflow(handle);
return handle ? handle : ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
} }
struct ion_handle *ion_handle_get_by_id(struct ion_client *client, struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
@ -1412,7 +1422,7 @@ struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd)
/* if a handle exists for this buffer just take a reference to it */ /* if a handle exists for this buffer just take a reference to it */
handle = ion_handle_lookup(client, buffer); handle = ion_handle_lookup(client, buffer);
if (!IS_ERR(handle)) { if (!IS_ERR(handle)) {
ion_handle_get(handle); handle = ion_handle_get_check_overflow(handle);
mutex_unlock(&client->lock); mutex_unlock(&client->lock);
goto end; goto end;
} }