lkml.org 
[lkml]   [2018]   [Oct]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 33/94] staging: android: ashmem: Fix mmap size validation
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alistair Strachan <astrachan@google.com>

    [ Upstream commit 8632c614565d0c5fdde527889601c018e97b6384 ]

    The ashmem driver did not check that the size/offset of the vma passed
    to its .mmap() function was not larger than the ashmem object being
    mapped. This could cause mmap() to succeed, even though accessing parts
    of the mapping would later fail with a segmentation fault.

    Ensure an error is returned by the ashmem_mmap() function if the vma
    size is larger than the ashmem object size. This enables safer handling
    of the problem in userspace.

    Cc: Todd Kjos <tkjos@android.com>
    Cc: devel@driverdev.osuosl.org
    Cc: linux-kernel@vger.kernel.org
    Cc: kernel-team@android.com
    Cc: Joel Fernandes <joel@joelfernandes.org>
    Signed-off-by: Alistair Strachan <astrachan@google.com>
    Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
    Reviewed-by: Martijn Coenen <maco@android.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/staging/android/ashmem.c | 6 ++++++
    1 file changed, 6 insertions(+)

    --- a/drivers/staging/android/ashmem.c
    +++ b/drivers/staging/android/ashmem.c
    @@ -383,6 +383,12 @@ static int ashmem_mmap(struct file *file
    goto out;
    }

    + /* requested mapping size larger than object size */
    + if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
    + ret = -EINVAL;
    + goto out;
    + }
    +
    /* requested protection bits must match our allowed protection mask */
    if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
    calc_vm_prot_bits(PROT_MASK, 0))) {

    \
     
     \ /
      Last update: 2018-10-02 15:44    [W:3.876 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site