4.15-stable patches

added patches:
	staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch

diff --git a/queue-4.15/series b/queue-4.15/series
index f86d90d74a7b4ecc64298e0493a3d5223158d739..20846c5cc1db81e5c9f2d0e956ec83126889c7fb 100644 (file)
--- a/queue-4.15/series
+++ b/queue-4.15/series
@@ -1 +1,2 @@
 scsi-megaraid_sas-do-not-use-32-bit-atomic-request-descriptor-for-ventura-controllers.patch
+staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch

diff --git a/queue-4.15/staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch b/queue-4.15/staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch
new file mode 100644 (file)
index 0000000..54b568c
--- /dev/null
+++ b/queue-4.15/staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch
@@ -0,0 +1,56 @@
+From 740a5759bf222332fbb5eda42f89aa25ba38f9b2 Mon Sep 17 00:00:00 2001
+From: Yisheng Xie <xieyisheng1@huawei.com>
+Date: Wed, 28 Feb 2018 14:59:22 +0800
+Subject: staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
+
+From: Yisheng Xie <xieyisheng1@huawei.com>
+
+commit 740a5759bf222332fbb5eda42f89aa25ba38f9b2 upstream.
+
+ashmem_mutex may create a chain of dependencies like:
+
+CPU0                                    CPU1
+ mmap syscall                           ioctl syscall
+ -> mmap_sem (acquired)                 -> ashmem_ioctl
+ -> ashmem_mmap                            -> ashmem_mutex (acquired)
+    -> ashmem_mutex (try to acquire)       -> copy_from_user
+                                              -> mmap_sem (try to acquire)
+
+There is a lock odering problem between mmap_sem and ashmem_mutex causing
+a lockdep splat[1] during a syzcaller test. This patch fixes the problem
+by move copy_from_user out of ashmem_mutex.
+
+[1] https://www.spinics.net/lists/kernel/msg2733200.html
+
+Fixes: ce8a3a9e76d0 (staging: android: ashmem: Fix a race condition in pin ioctls)
+Reported-by: syzbot+d7a918a7a8e1c952bc36@syzkaller.appspotmail.com
+Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
+Cc: "Joel Fernandes (Google)" <joel.opensrc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/ashmem.c |    8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -709,16 +709,14 @@ static int ashmem_pin_unpin(struct ashme
+       size_t pgstart, pgend;
+       int ret = -EINVAL;
+ 
++      if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
++              return -EFAULT;
++
+       mutex_lock(&ashmem_mutex);
+ 
+       if (unlikely(!asma->file))
+               goto out_unlock;
+ 
+-      if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
+-              ret = -EFAULT;
+-              goto out_unlock;
+-      }
+-
+       /* per custom, you can pass zero for len to mean "everything onward" */
+       if (!pin.len)
+               pin.len = PAGE_ALIGN(asma->size) - pin.offset;