]> git.karo-electronics.de Git - linux-beck.git/commit
staging/android/ion : fix a race condition in the ion driver
authorEunTaik Lee <eun.taik.lee@samsung.com>
Wed, 24 Feb 2016 04:38:06 +0000 (04:38 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 12 Mar 2016 06:09:09 +0000 (22:09 -0800)
commit9590232bb4f4cc824f3425a6e1349afbe6d6d2b7
tree36417b9b1022093303372f59d21c43e2b19ae3ce
parent5a20df724f712e9daa9fd41b430ff63ecd203e85
staging/android/ion : fix a race condition in the ion driver

There is a use-after-free problem in the ion driver.
This is caused by a race condition in the ion_ioctl()
function.

A handle has ref count of 1 and two tasks on different
cpus calls ION_IOC_FREE simultaneously.

cpu 0                                   cpu 1
-------------------------------------------------------
ion_handle_get_by_id()
(ref == 2)
                            ion_handle_get_by_id()
                            (ref == 3)

ion_free()
(ref == 2)

ion_handle_put()
(ref == 1)

                            ion_free()
                            (ref == 0 so ion_handle_destroy() is
                            called
                            and the handle is freed.)

                            ion_handle_put() is called and it
                            decreases the slub's next free pointer

The problem is detected as an unaligned access in the
spin lock functions since it uses load exclusive
 instruction. In some cases it corrupts the slub's
free pointer which causes a mis-aligned access to the
next free pointer.(kmalloc returns a pointer like
ffffc0745b4580aa). And it causes lots of other
hard-to-debug problems.

This symptom is caused since the first member in the
ion_handle structure is the reference count and the
ion driver decrements the reference after it has been
freed.

To fix this problem client->lock mutex is extended
to protect all the codes that uses the handle.

Signed-off-by: Eun Taik Lee <eun.taik.lee@samsung.com>
Reviewed-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/staging/android/ion/ion.c [changed mode: 0644->0755]