lkml.org 
[lkml]   [2019]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.0 16/46] staging: android: ashmem: Avoid range_alloc() allocation with ashmem_mutex held.
    Date
    5.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

    commit ecd182cbf4e107928077866399100228d2359c60 upstream.

    ashmem_pin() is calling range_shrink() without checking whether
    range_alloc() succeeded. Also, doing memory allocation with ashmem_mutex
    held should be avoided because ashmem_shrink_scan() tries to hold it.

    Therefore, move memory allocation for range_alloc() to ashmem_pin_unpin()
    and make range_alloc() not to fail.

    This patch is mostly meant for backporting purpose for fuzz testing on
    stable/distributor kernels, for there is a plan to remove this code in
    near future.

    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    Cc: stable@vger.kernel.org
    Reviewed-by: Joel Fernandes <joel@joelfernandes.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/staging/android/ashmem.c | 42 ++++++++++++++++++++++-----------------
    1 file changed, 24 insertions(+), 18 deletions(-)

    --- a/drivers/staging/android/ashmem.c
    +++ b/drivers/staging/android/ashmem.c
    @@ -171,19 +171,15 @@ static inline void lru_del(struct ashmem
    * @end: The ending page (inclusive)
    *
    * This function is protected by ashmem_mutex.
    - *
    - * Return: 0 if successful, or -ENOMEM if there is an error
    */
    -static int range_alloc(struct ashmem_area *asma,
    - struct ashmem_range *prev_range, unsigned int purged,
    - size_t start, size_t end)
    +static void range_alloc(struct ashmem_area *asma,
    + struct ashmem_range *prev_range, unsigned int purged,
    + size_t start, size_t end,
    + struct ashmem_range **new_range)
    {
    - struct ashmem_range *range;
    -
    - range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL);
    - if (!range)
    - return -ENOMEM;
    + struct ashmem_range *range = *new_range;

    + *new_range = NULL;
    range->asma = asma;
    range->pgstart = start;
    range->pgend = end;
    @@ -193,8 +189,6 @@ static int range_alloc(struct ashmem_are

    if (range_on_lru(range))
    lru_add(range);
    -
    - return 0;
    }

    /**
    @@ -596,7 +590,8 @@ static int get_name(struct ashmem_area *
    *
    * Caller must hold ashmem_mutex.
    */
    -static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
    +static int ashmem_pin(struct ashmem_area *asma, size_t pgstart, size_t pgend,
    + struct ashmem_range **new_range)
    {
    struct ashmem_range *range, *next;
    int ret = ASHMEM_NOT_PURGED;
    @@ -649,7 +644,7 @@ static int ashmem_pin(struct ashmem_area
    * second half and adjust the first chunk's endpoint.
    */
    range_alloc(asma, range, range->purged,
    - pgend + 1, range->pgend);
    + pgend + 1, range->pgend, new_range);
    range_shrink(range, range->pgstart, pgstart - 1);
    break;
    }
    @@ -663,7 +658,8 @@ static int ashmem_pin(struct ashmem_area
    *
    * Caller must hold ashmem_mutex.
    */
    -static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend)
    +static int ashmem_unpin(struct ashmem_area *asma, size_t pgstart, size_t pgend,
    + struct ashmem_range **new_range)
    {
    struct ashmem_range *range, *next;
    unsigned int purged = ASHMEM_NOT_PURGED;
    @@ -689,7 +685,8 @@ restart:
    }
    }

    - return range_alloc(asma, range, purged, pgstart, pgend);
    + range_alloc(asma, range, purged, pgstart, pgend, new_range);
    + return 0;
    }

    /*
    @@ -722,10 +719,17 @@ static int ashmem_pin_unpin(struct ashme
    struct ashmem_pin pin;
    size_t pgstart, pgend;
    int ret = -EINVAL;
    + struct ashmem_range *range = NULL;

    if (copy_from_user(&pin, p, sizeof(pin)))
    return -EFAULT;

    + if (cmd == ASHMEM_PIN || cmd == ASHMEM_UNPIN) {
    + range = kmem_cache_zalloc(ashmem_range_cachep, GFP_KERNEL);
    + if (!range)
    + return -ENOMEM;
    + }
    +
    mutex_lock(&ashmem_mutex);
    wait_event(ashmem_shrink_wait, !atomic_read(&ashmem_shrink_inflight));

    @@ -750,10 +754,10 @@ static int ashmem_pin_unpin(struct ashme

    switch (cmd) {
    case ASHMEM_PIN:
    - ret = ashmem_pin(asma, pgstart, pgend);
    + ret = ashmem_pin(asma, pgstart, pgend, &range);
    break;
    case ASHMEM_UNPIN:
    - ret = ashmem_unpin(asma, pgstart, pgend);
    + ret = ashmem_unpin(asma, pgstart, pgend, &range);
    break;
    case ASHMEM_GET_PIN_STATUS:
    ret = ashmem_get_pin_status(asma, pgstart, pgend);
    @@ -762,6 +766,8 @@ static int ashmem_pin_unpin(struct ashme

    out_unlock:
    mutex_unlock(&ashmem_mutex);
    + if (range)
    + kmem_cache_free(ashmem_range_cachep, range);

    return ret;
    }

    \
     
     \ /
      Last update: 2019-03-08 14:10    [W:2.576 / U:0.260 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site