From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg0-f65.google.com ([74.125.83.65]:35470 "EHLO mail-pg0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755588AbeAHSoR (ORCPT ); Mon, 8 Jan 2018 13:44:17 -0500 Received: by mail-pg0-f65.google.com with SMTP id d6so5056905pgv.2 for ; Mon, 08 Jan 2018 10:44:17 -0800 (PST) From: Greg Hackmann To: Greg Kroah-Hartman , =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= , Todd Kjos , Martijn Coenen Cc: devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org, Viktor Slavkovic , stable@vger.kernel.org Subject: [PATCH] staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl Date: Mon, 8 Jan 2018 10:43:03 -0800 Message-Id: <20180108184303.55563-1-ghackmann@google.com> Sender: stable-owner@vger.kernel.org List-ID: From: Viktor Slavkovic A lock-unlock is missing in ASHMEM_SET_SIZE ioctl which can result in a race condition when mmap is called. After the !asma->file check, before setting asma->size, asma->file can be set in mmap. That would result in having different asma->size than the mapped memory size. Combined with ASHMEM_UNPIN ioctl and shrinker invocation, this can result in memory corruption. Signed-off-by: Viktor Slavkovic Cc: stable@vger.kernel.org --- drivers/staging/android/ashmem.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 0f695df14c9d..372ce9913e6d 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -765,10 +765,12 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) break; case ASHMEM_SET_SIZE: ret = -EINVAL; + mutex_lock(&ashmem_mutex); if (!asma->file) { ret = 0; asma->size = (size_t)arg; } + mutex_unlock(&ashmem_mutex); break; case ASHMEM_GET_SIZE: ret = asma->size; -- 2.16.0.rc0.223.g4a4ac83678-goog