linux-stable.git/drivers/staging/android, branch v4.9.86

staging: android: ashmem: Fix a race condition in pin ioctls

2018-02-25T10:05:44+00:00

commit ce8a3a9e76d0193e2e8d74a06d275b3c324ca652 upstream.

ashmem_pin_unpin() reads asma->file and asma->size before taking the
ashmem_mutex, so it can race with other operations that modify them.

Build-tested only.

Signed-off-by: Ben Hutchings 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Switch from WARN to pr_warn

2018-02-25T10:05:42+00:00

commit e4e179a844f52e907e550f887d0a2171f1508af1 upstream.

Syzbot reported a warning with Ion:

WARNING: CPU: 0 PID: 3502 at drivers/staging/android/ion/ion-ioctl.c:73 ion_ioctl+0x2db/0x380 drivers/staging/android/ion/ion-ioctl.c:73
Kernel panic - not syncing: panic_on_warn set ...

This is a warning that validation of the ioctl fields failed. This was
deliberately added as a warning to make it very obvious to developers that
something needed to be fixed. In reality, this is overkill and disturbs
fuzzing. Switch to pr_warn for a message instead.

Reported-by: syzbot+fa2d5f63ee5904a0115a@syzkaller.appspotmail.com
Reported-by: syzbot 
Signed-off-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Add __GFP_NOWARN for system contig heap

2018-02-25T10:05:42+00:00

commit 0c75f10312a35b149b2cebb1832316b35c2337ca upstream.

syzbot reported a warning from Ion:

  WARNING: CPU: 1 PID: 3485 at mm/page_alloc.c:3926

  ...
   __alloc_pages_nodemask+0x9fb/0xd80 mm/page_alloc.c:4252
  alloc_pages_current+0xb6/0x1e0 mm/mempolicy.c:2036
  alloc_pages include/linux/gfp.h:492 [inline]
  ion_system_contig_heap_allocate+0x40/0x2c0
  drivers/staging/android/ion/ion_system_heap.c:374
  ion_buffer_create drivers/staging/android/ion/ion.c:93 [inline]
  ion_alloc+0x2c1/0x9e0 drivers/staging/android/ion/ion.c:420
  ion_ioctl+0x26d/0x380 drivers/staging/android/ion/ion-ioctl.c:84
  vfs_ioctl fs/ioctl.c:46 [inline]
  do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
  SYSC_ioctl fs/ioctl.c:701 [inline]
  SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692

This is a warning about attempting to allocate order > MAX_ORDER. This
is coming from a userspace Ion allocation request. Since userspace is
free to request however much memory it wants (and the kernel is free to
deny its allocation), silence the allocation attempt with __GFP_NOWARN
in case it fails.

Reported-by: syzbot+76e7efc4748495855a4d@syzkaller.appspotmail.com
Reported-by: syzbot 
Signed-off-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl

2018-01-17T08:38:56+00:00

commit 443064cb0b1fb4569fe0a71209da7625129fb760 upstream.

A lock-unlock is missing in ASHMEM_SET_SIZE ioctl which can result in a
race condition when mmap is called. After the !asma->file check, before
setting asma->size, asma->file can be set in mmap. That would result in
having different asma->size than the mapped memory size. Combined with
ASHMEM_UNPIN ioctl and shrinker invocation, this can result in memory
corruption.

Signed-off-by: Viktor Slavkovic 
Signed-off-by: Greg Kroah-Hartman

staging: android: ashmem: lseek failed due to no FMODE_LSEEK.

2017-04-12T10:41:11+00:00

commit 97fbfef6bd597888485b653175fb846c6998b60c upstream.

vfs_llseek will check whether the file mode has
FMODE_LSEEK, no return failure. But ashmem can be
lseek, so add FMODE_LSEEK to ashmem file.

Comment From Greg Hackmann:
	ashmem_llseek() passes the llseek() call through to the backing
	shmem file.  91360b02ab48 ("ashmem: use vfs_llseek()") changed
	this from directly calling the file's llseek() op into a VFS
	layer call.  This also adds a check for the FMODE_LSEEK bit, so
	without that bit ashmem_llseek() now always fails with -ESPIPE.

Fixes: 91360b02ab48 ("ashmem: use vfs_llseek()")
Signed-off-by: Shuxiao Zhang 
Tested-by: Greg Hackmann 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: Fix error handling in ion_query_heaps()

2016-10-24T13:36:15+00:00

If the copy_to_user() fails we should unlock and return directly without
updating "cnt".  Also the return value should be -EFAULT instead of the
number of bytes remaining.

Fixes: 02b23803c6af ("staging: android: ion: Add ioctl to query available heaps")
Signed-off-by: Dan Carpenter 
Signed-off-by: Greg Kroah-Hartman

staging: android/ion: testing the wrong variable

2016-10-17T07:14:55+00:00

We're testing "pdev" but we intended to test "heap_pdev".  This is a
static checker fix and it's unlikely that anyone is affected by this
bug.

Fixes: 13439479c7de ('staging: ion: Add files for parsing the devicetree')
Signed-off-by: Dan Carpenter 
Acked-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: fix checks found by checkpatch.pl

2016-10-02T14:58:29+00:00

Alignment fixes

Signed-off-by: Wayne Porter 
Signed-off-by: Greg Kroah-Hartman

staging: android: ion: fix warning found by checkpatch.pl

2016-10-02T14:58:29+00:00

Fix checkpatch.pl warning:
WARNING: braces {} are not necessary for single statement blocks

Signed-off-by: Wayne Porter 
Signed-off-by: Greg Kroah-Hartman

staging:android:ion: Fix whitespace issue

2016-09-27T11:14:48+00:00

This patch fixes the following whitespace issue:

CHECK: spaces preferred around that '*' (ctx:VxV)
FILE: drivers/staging/android/ion/ion_of.c:91:
+                            sizeof(struct ion_platform_heap)*num_heaps,

Signed-off-by: Yannis Damigos 
Signed-off-by: Greg Kroah-Hartman