Commit 8632c614 authored Jun 19, 2018 by Alistair Strachan Committed by Greg Kroah-Hartman Jun 28, 2018

staging: android: ashmem: Fix mmap size validation



The ashmem driver did not check that the size/offset of the vma passed
to its .mmap() function was not larger than the ashmem object being
mapped. This could cause mmap() to succeed, even though accessing parts
of the mapping would later fail with a segmentation fault.

Ensure an error is returned by the ashmem_mmap() function if the vma
size is larger than the ashmem object size. This enables safer handling
of the problem in userspace.

Cc: Todd Kjos <tkjos@android.com>
Cc: devel@driverdev.osuosl.org
Cc: linux-kernel@vger.kernel.org
Cc: kernel-team@android.com
Cc: Joel Fernandes <joel@joelfernandes.org>
Signed-off-by: Alistair Strachan <astrachan@google.com>
Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Reviewed-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 59848d6a

drivers/staging/android/ashmem.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -366,6 +366,12 @@ static int ashmem_mmap(struct file file, struct vm_area_struct vma)
		goto out;
		}

		/* requested mapping size larger than object size */
		if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
		ret = -EINVAL;
		goto out;
		}

		/* requested protection bits must match our allowed protection mask */
		if ((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
		calc_vm_prot_bits(PROT_MASK, 0)) {