Viktor Slavkovic 443064cb0b staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl ...

A lock-unlock is missing in ASHMEM_SET_SIZE ioctl which can result in a
race condition when mmap is called. After the !asma->file check, before
setting asma->size, asma->file can be set in mmap. That would result in
having different asma->size than the mapped memory size. Combined with
ASHMEM_UNPIN ioctl and shrinker invocation, this can result in memory
corruption.

Signed-off-by: Viktor Slavkovic <viktors@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-01-09 15:32:11 +01:00

..

ion

staging: android: ion: Fix dma direction for dma_sync_sg_for_cpu/device

2017-12-19 15:53:39 +01:00

uapi

staging: android: uapi: drop definitions of removed ION_IOC_{FREE,SHARE} ioctls

2017-06-03 17:38:26 +09:00

ashmem.c

staging: android: ashmem: fix a race condition in ASHMEM_SET_SIZE ioctl

2018-01-09 15:32:11 +01:00

ashmem.h

staging: android: Split uapi out of ashmem.h

2014-02-18 11:03:28 -08:00

Kconfig

staging, android: remove lowmemory killer from the tree

2017-03-09 13:47:03 +01:00

Makefile

staging, android: remove lowmemory killer from the tree

2017-03-09 13:47:03 +01:00

TODO

staging: android: TODO: Removing an invalid issue

2017-10-03 18:36:57 +02:00