Received: by 10.223.185.116 with SMTP id b49csp1079048wrg; Fri, 23 Feb 2018 11:32:20 -0800 (PST) X-Google-Smtp-Source: AH8x2270/WasWPA9JSoq6/+pLX+gzYZSQgC39+LrX016FqdE/N3p/8W68bRYIbCyNZ50ftL66fHm X-Received: by 2002:a17:902:7b95:: with SMTP id w21-v6mr2630365pll.35.1519414340326; Fri, 23 Feb 2018 11:32:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519414340; cv=none; d=google.com; s=arc-20160816; b=z9plPgI4SfrWsyEPDfOvGdMxLSYNkRd+nVTSv4S7axL8lHYTUSZb4VOUaHtS+L1yxj Vqh507Mpll6YwhdHhLKglSX876gG9yngMmRfGI9E9/rEUh0JgQO8swtFLJwop/S3K8OL ge/3GsiNu+PKwltLuNeBFM20739Pmhj6Lx99eKjAIYUSKFqEAvBZ6JkaHw/u6ZzzbxdX lMEST1vxBdsuX+f+cYpm9sVu0Hm8TU5Cd8RkSH9jbFYZCf9/Qw2gZkr+ankOYUa8VXEH 44ZJat7wUXWBKhEKiCODbPFD4tSFLIeGCtyssC326sshOM9UNpVGrVfK+vuC2nRGhexQ dtbw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=PmWMEGZfC6eXEWDJ52VurlXi87P4qkFCu8oDhTMcyG4=; b=Y7B6KjdN4EfKaCuOlBeQM6GzXTKwLfKJJC8ub4HJW96dD0p8qtVbbVnXX6iZXcz6To yy/eP3O15m3hawGz9z7oeLUshgwKxFlCAhAKNKRCquxOgH+97RqIvdlEE74c7jHjbLgk PU15O+ctuninm+9ey9N15X97RCZhHDmSaFGqQlzyXTUZGSaRossjiYg7rSuP+s9NR9jb J0+Pkz0H++wjvt4iIX+uGckm8NjOCbDeP/RAbheXECCw45M0FxV67aACazX00VeWf4D7 XxemC2jSKztQsg8GkCtClYexGm8sMQjCGeYY/NrzwXbmZ7w3b1BSHHVVGjg4pWuOtMTG eFnw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id x10si2255502pfd.188.2018.02.23.11.32.06; Fri, 23 Feb 2018 11:32:20 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754693AbeBWTb0 (ORCPT + 99 others); Fri, 23 Feb 2018 14:31:26 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:46044 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934970AbeBWSvc (ORCPT ); Fri, 23 Feb 2018 13:51:32 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id ADC231317; Fri, 23 Feb 2018 18:51:31 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Hutchings Subject: [PATCH 4.14 052/159] staging: android: ashmem: Fix a race condition in pin ioctls Date: Fri, 23 Feb 2018 19:26:00 +0100 Message-Id: <20180223170749.845639372@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings commit ce8a3a9e76d0193e2e8d74a06d275b3c324ca652 upstream. ashmem_pin_unpin() reads asma->file and asma->size before taking the ashmem_mutex, so it can race with other operations that modify them. Build-tested only. Signed-off-by: Ben Hutchings Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ashmem.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -710,30 +710,32 @@ static int ashmem_pin_unpin(struct ashme size_t pgstart, pgend; int ret = -EINVAL; + mutex_lock(&ashmem_mutex); + if (unlikely(!asma->file)) - return -EINVAL; + goto out_unlock; - if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) - return -EFAULT; + if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { + ret = -EFAULT; + goto out_unlock; + } /* per custom, you can pass zero for len to mean "everything onward" */ if (!pin.len) pin.len = PAGE_ALIGN(asma->size) - pin.offset; if (unlikely((pin.offset | pin.len) & ~PAGE_MASK)) - return -EINVAL; + goto out_unlock; if (unlikely(((__u32)-1) - pin.offset < pin.len)) - return -EINVAL; + goto out_unlock; if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len)) - return -EINVAL; + goto out_unlock; pgstart = pin.offset / PAGE_SIZE; pgend = pgstart + (pin.len / PAGE_SIZE) - 1; - mutex_lock(&ashmem_mutex); - switch (cmd) { case ASHMEM_PIN: ret = ashmem_pin(asma, pgstart, pgend); @@ -746,6 +748,7 @@ static int ashmem_pin_unpin(struct ashme break; } +out_unlock: mutex_unlock(&ashmem_mutex); return ret;