Merge "staging: android: ion: fix ION_IOC_IMPORT use-after-free" (a2fad6d1) · Commits · e / devices / android_kernel_sony_msm8998

drivers/staging/android/ion/ion.c

+4 −4

Original line number	Original line	Diff line number	Diff line
	@@ -453,16 +453,14 @@ static struct ion_handle *user_ion_handle_get_check_overflow(
	/* passes a kref to the user ref count.		/* passes a kref to the user ref count.
	* We know we're holding a kref to the object before and		* We know we're holding a kref to the object before and
	* after this call, so no need to reverify handle.		* after this call, so no need to reverify handle.
			* Caller must hold the client lock, except for ION_IOC_ALLOC.
	*/		*/
	static struct ion_handle pass_to_user(struct ion_handle handle)		static struct ion_handle pass_to_user(struct ion_handle handle)
	{		{
	struct ion_client *client = handle->client;
	struct ion_handle *ret;		struct ion_handle *ret;

	mutex_lock(&client->lock);
	ret = user_ion_handle_get_check_overflow(handle);		ret = user_ion_handle_get_check_overflow(handle);
	ion_handle_put_nolock(handle);		ion_handle_put_nolock(handle);
	mutex_unlock(&client->lock);
	return ret;		return ret;
	}		}

	@@ -1700,7 +1698,8 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
	{		{
	struct ion_handle *handle;		struct ion_handle *handle;

	handle = ion_import_dma_buf(client, data.fd.fd);		mutex_lock(&client->lock);
			handle = ion_import_dma_buf_nolock(client, data.fd.fd);
	if (IS_ERR(handle)) {		if (IS_ERR(handle)) {
	ret = PTR_ERR(handle);		ret = PTR_ERR(handle);
	} else {		} else {
	@@ -1710,6 +1709,7 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
	else		else
	data.handle.handle = handle->id;		data.handle.handle = handle->id;
	}		}
			mutex_unlock(&client->lock);
	break;		break;
	}		}
	case ION_IOC_SYNC:		case ION_IOC_SYNC: