Re: [PATCH 1/1] staging: ion: Prevent incorrect reference counting behavour

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Nov 25, 2021 at 12:46:23PM +0000, Lee Jones wrote:
> On Thu, 25 Nov 2021, Greg KH wrote:
> 
> > On Thu, Nov 25, 2021 at 12:02:34PM +0000, Lee Jones wrote:
> > > Supply additional checks in order to prevent unexpected results.
> > > 
> > > Fixes: b892bf75b2034 ("ion: Switch ion to use dma-buf")
> > > Signed-off-by: Lee Jones <lee.jones@linaro.org>
> > > ---
> > >  drivers/staging/android/ion/ion.c | 3 +++
> > >  1 file changed, 3 insertions(+)
> > > 
> > > diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
> > > index 806e9b30b9dc8..30f359faba575 100644
> > > --- a/drivers/staging/android/ion/ion.c
> > > +++ b/drivers/staging/android/ion/ion.c
> > > @@ -509,6 +509,9 @@ static void *ion_handle_kmap_get(struct ion_handle *handle)
> > >  	void *vaddr;
> > >  
> > >  	if (handle->kmap_cnt) {
> > > +		if (handle->kmap_cnt + 1 < handle->kmap_cnt)
> > 
> > What about using the nice helpers in overflow.h for this?
> 
> I haven't heard of these before.
> 
> Looks like they're not widely used.
> 
> I'll try them out and see how they go.
> 
> > > +			return ERR_PTR(-EOVERFLOW);
> > > +
> > >  		handle->kmap_cnt++;
> > >  		return buffer->vaddr;
> > >  	}
> > 
> > What stable kernel branch(es) is this for?
> 
> I assumed your magic scripts could determine this from the Fixes:
> tag.  I'll be more explicit in v2.

The fixes tag says how far back for it to go, but not where to start
that process from :)

thanks,

greg k-h