linux-stable.git/drivers/staging/android/ion, branch v4.1.44

staging/android/ion : fix a race condition in the ion driver

2017-06-13T13:29:17+00:00

[ Upstream commit 9590232bb4f4cc824f3425a6e1349afbe6d6d2b7 ]

There is a use-after-free problem in the ion driver.
This is caused by a race condition in the ion_ioctl()
function.

A handle has ref count of 1 and two tasks on different
cpus calls ION_IOC_FREE simultaneously.

cpu 0                                   cpu 1
-------------------------------------------------------
ion_handle_get_by_id()
(ref == 2)
                            ion_handle_get_by_id()
                            (ref == 3)

ion_free()
(ref == 2)

ion_handle_put()
(ref == 1)

                            ion_free()
                            (ref == 0 so ion_handle_destroy() is
                            called
                            and the handle is freed.)

                            ion_handle_put() is called and it
                            decreases the slub's next free pointer

The problem is detected as an unaligned access in the
spin lock functions since it uses load exclusive
 instruction. In some cases it corrupts the slub's
free pointer which causes a mis-aligned access to the
next free pointer.(kmalloc returns a pointer like
ffffc0745b4580aa). And it causes lots of other
hard-to-debug problems.

This symptom is caused since the first member in the
ion_handle structure is the reference count and the
ion driver decrements the reference after it has been
freed.

To fix this problem client->lock mutex is extended
to protect all the codes that uses the handle.

Signed-off-by: Eun Taik Lee 
Reviewed-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

staging: ion: fix corruption of ion_import_dma_buf

2015-10-22T21:43:17+00:00

commit 6fa92e2bcf6390e64895b12761e851c452d87bd8 upstream.

we found this issue but still exit in lastest kernel. Simply
keep ion_handle_create under mutex_lock to avoid this race.

WARNING: CPU: 2 PID: 2648 at drivers/staging/android/ion/ion.c:512 ion_handle_add+0xb4/0xc0()
ion_handle_add: buffer already found.
Modules linked in: iwlmvm iwlwifi mac80211 cfg80211 compat
CPU: 2 PID: 2648 Comm: TimedEventQueue Tainted: G        W    3.14.0 #7
 00000000 00000000 9a3efd2c 80faf273 9a3efd6c 9a3efd5c 80935dc9 811d7fd3
 9a3efd88 00000a58 812208a0 00000200 80e128d4 80e128d4 8d4ae00c a8cd8600
 a8cd8094 9a3efd74 80935e0e 00000009 9a3efd6c 811d7fd3 9a3efd88 9a3efd9c
Call Trace:
  [<80faf273>] dump_stack+0x48/0x69
  [<80935dc9>] warn_slowpath_common+0x79/0x90
  [<80e128d4>] ? ion_handle_add+0xb4/0xc0
  [<80e128d4>] ? ion_handle_add+0xb4/0xc0
  [<80935e0e>] warn_slowpath_fmt+0x2e/0x30
  [<80e128d4>] ion_handle_add+0xb4/0xc0
  [<80e144cc>] ion_import_dma_buf+0x8c/0x110
  [<80c517c4>] reg_init+0x364/0x7d0
  [<80993363>] ? futex_wait+0x123/0x210
  [<80992e0e>] ? get_futex_key+0x16e/0x1e0
  [<8099308f>] ? futex_wake+0x5f/0x120
  [<80c51e19>] vpu_service_ioctl+0x1e9/0x500
  [<80994aec>] ? do_futex+0xec/0x8e0
  [<80971080>] ? prepare_to_wait_event+0xc0/0xc0
  [<80c51c30>] ? reg_init+0x7d0/0x7d0
  [<80a22562>] do_vfs_ioctl+0x2d2/0x4c0
  [<80b198ad>] ? inode_has_perm.isra.41+0x2d/0x40
  [<80b199cf>] ? file_has_perm+0x7f/0x90
  [<80b1a5f7>] ? selinux_file_ioctl+0x47/0xf0
  [<80a227a8>] SyS_ioctl+0x58/0x80
  [<80fb45e8>] syscall_call+0x7/0x7
  [<80fb0000>] ? mmc_do_calc_max_discard+0xab/0xe4

Fixes: 83271f626 ("ion: hold reference to handle...")
Signed-off-by: Shawn Lin 
Reviewed-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: fix wrong init of dma_buf_export_info

2015-04-21T09:17:16+00:00

Fixes: 817bd7253291 ("dma-buf: cleanup dma_buf_export() to make it
easily extensible")

Stupid copy-paste from me in the above patch leads to the following static
checker warning:

        drivers/staging/android/ion/ion.c:1112 ion_share_dma_buf()
        error: potentially dereferencing uninitialized 'buffer'.

drivers/staging/android/ion/ion.c
  1103  struct dma_buf *ion_share_dma_buf(struct ion_client *client,
  1104                                                  struct
ion_handle *handle)
  1105  {
  1106          struct ion_buffer *buffer;
                                   ^^^^^^
  1107          struct dma_buf *dmabuf;
  1108          bool valid_handle;
  1109          DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
  1110
  1111          exp_info.ops = &dma_buf_ops;
  1112          exp_info.size = buffer->size;
                                ^^^^^^
  1113          exp_info.flags = O_RDWR;
  1114          exp_info.priv = buffer;
                                ^^^^^^
And here also.

  1115

This patch corrects this stupidity.

Reported-by: Dan Carpenter 
Reviewed-by: Dan Carpenter 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Sumit Semwal

dma-buf: cleanup dma_buf_export() to make it easily extensible

2015-04-21T09:17:16+00:00

At present, dma_buf_export() takes a series of parameters, which
makes it difficult to add any new parameters for exporters, if required.

Make it simpler by moving all these parameters into a struct, and pass
the struct * as parameter to dma_buf_export().

While at it, unite dma_buf_export_named() with dma_buf_export(), and
change all callers accordingly.

Reviewed-by: Maarten Lankhorst 
Reviewed-by: Daniel Thompson 
Acked-by: Mauro Carvalho Chehab 
Acked-by: Dave Airlie 
Signed-off-by: Sumit Semwal

staging: android: ion_test: Add the MODULE_LICENSE macro

2015-04-03T13:13:52+00:00

Base on the file comment should define GPL v2 for ion test driver

Signed-off-by: Phong Tran 
Signed-off-by: Greg Kroah-Hartman

ion: improve ion_phys error message

2015-03-20T12:44:39+00:00

Clients often get confused when ion_phys errors out due to some heap
being used that they didn't expect.  Add the heap name and heap type to
the error message to make it more obvious.

Signed-off-by: Mitchel Humpherys 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: fix some format strings

2015-03-02T02:46:15+00:00

C99 says that a precision which is simply '.' with no following digits
or * should be interpreted as 0, which means that these format strings
actually mean 'print 16 spaces'. However, the kernel's printf
implementation treats this case as if the precision was omitted. Don't
rely on that quirk.

Signed-off-by: Rasmus Villemoes 
Signed-off-by: Greg Kroah-Hartman

staging: ion: always initialize the free list parameters

2015-01-18T00:16:00+00:00

Currently we initialize the heap free_lock and free list size in
ion_heap_init_deferred_free, which is only called when the
ION_HEAP_FLAG_DEFER_FREE heap flag is given.  However, the lock and size
are used in the shrinker path as well as the deferred free path, and we
can register a shrinker *without* enabling deferred freeing.  So, if a
heap provides a shrinker but *doesn't* set the DEFER_FREE flag we will
use these parameters uninitialized (resulting in a spinlock bug and
broken shrinker accounting).

Fix these problems by initializing the free list parameters directly in
ion_device_add_heap, which is always called no matter which heap
features are being used.

Signed-off-by: Mitchel Humpherys 
Signed-off-by: Greg Kroah-Hartman

staging: ion: ion_cma_heap: remove ion_cma_get_sgtable

2015-01-18T00:14:16+00:00

Remove the temporary code ion_cma_get_sgtable,
use dma_common_get_sgtable instead

Signed-off-by: Zeng Tao 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Deletion of unnecessary checks before two function calls

2014-11-26T21:42:53+00:00

The functions ion_heap_destroy() and vfree() perform also input
parameter validation. Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring 
Signed-off-by: Greg Kroah-Hartman