Patch "staging: android: ion: fix ION_IOC_{MAP, SHARE} use-after-free" has been added to the 4.4-stable tree

2018-09-10 Thread gregkh
This is a note to let you know that I've just added the patch titled staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch

Re: [PATCH] staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free

2018-09-01 Thread Greg Kroah-Hartman
On Fri, Aug 31, 2018 at 01:30:01PM -0700, Greg Hackmann wrote: > On 08/31/2018 01:27 PM, Greg Hackmann wrote: > > Change-Id: Ia0542dd8134e81cd5e1412e126545303c766f738 > > Sorry, please disregard the Change-Id line. This is what I get for > forgetting to re-run checkpatch after amending my commit

[PATCH] staging: android: ion: fix ION_IOC_{MAP, SHARE} use-after-free

2018-08-31 Thread Greg Hackmann
The ION_IOC_{MAP,SHARE} ioctls drop and reacquire client->lock several times while operating on one of the client's ion_handles. This creates windows where userspace can call ION_IOC_FREE on the same client with the same handle, and effectively make the kernel drop its own reference. For example:

Re: [PATCH] staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free

2018-08-31 Thread Greg Kroah-Hartman
On Fri, Aug 31, 2018 at 01:17:20PM -0700, Greg Hackmann wrote: > On 08/31/2018 01:12 PM, Greg Kroah-Hartman wrote: > > On Fri, Aug 31, 2018 at 01:06:27PM -0700, Greg Hackmann wrote: > >> The ION_IOC_{MAP,SHARE} ioctls drop and reacquire client->lock several > >> times while operating on one of the

Patch "staging: android: ion: fix ION_IOC_{MAP, SHARE} use-after-free" has been added to the 4.9-stable tree

2018-08-31 Thread gregkh
This is a note to let you know that I've just added the patch titled staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch

Re: [PATCH] staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free

2018-08-31 Thread Greg Kroah-Hartman
On Fri, Aug 31, 2018 at 01:06:27PM -0700, Greg Hackmann wrote: > The ION_IOC_{MAP,SHARE} ioctls drop and reacquire client->lock several > times while operating on one of the client's ion_handles. This creates > windows where userspace can call ION_IOC_FREE on the same client with > the same

[PATCH] staging: android: ion: fix ION_IOC_{MAP, SHARE} use-after-free

2018-08-31 Thread Greg Hackmann
The ION_IOC_{MAP,SHARE} ioctls drop and reacquire client->lock several times while operating on one of the client's ion_handles. This creates windows where userspace can call ION_IOC_FREE on the same client with the same handle, and effectively make the kernel drop its own reference. For example: