On Mon, Aug 20, 2018 at 06:30:57PM -0700, Daniel Rosenberg wrote:
Userspace can cause the kref to handles to increment arbitrarily high. Ensure it does not overflow.
Signed-off-by: Daniel Rosenberg drosen@google.com
This patch is against 4.4. It does not apply to master due to a large rework of ion in 4.12 which removed the affected functions altogther. It applies from 3.18 to 4.11, although with a trivial conflict resolution for the later branches. 4c23cbff073f3b9b ("staging: android: ion: Remove import interface")
drivers/staging/android/ion/ion.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index 374f840f31a48..11f93a6314fdb 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -15,6 +15,7 @@
*/ +#include <linux/atomic.h> #include <linux/device.h> #include <linux/err.h> #include <linux/file.h> @@ -387,6 +388,15 @@ static void ion_handle_get(struct ion_handle *handle) kref_get(&handle->ref); } +/* Must hold the client lock */ +static struct ion_handle *ion_handle_get_check_overflow(
struct ion_handle *handle)+{
- if (atomic_read(&handle->ref.refcount) + 1 == 0)
return ERR_PTR(-EOVERFLOW);- ion_handle_get(handle);
- return handle;
+}
static int ion_handle_put_nolock(struct ion_handle *handle) { int ret;
I tried to apply this patch, but it looks like you hand-edited it which made it impossible to apply. Did you do that, or did git really create this broken diff exactly as-is?
Try applying this patch yourself, you will see the error. I could fix it by manually editing the diff metadata but I really shouldn't have to as that implies you did not test the patch you sent me :(
thanks,
greg k-h