From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 22 Mar 2018 11:20:21 +0000 (+0100)
Subject: 4.4-stable patches
X-Git-Tag: v3.18.102~22
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=457281ea46b600c291e8d18267114081b8db83c0;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch
---

diff --git a/queue-4.4/series b/queue-4.4/series
index f0a94f8b034..93db92d8227 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -2,3 +2,4 @@ tpm-fix-potential-buffer-overruns-caused-by-bit-glitches-on-the-bus.patch
 tpm_tis-fix-potential-buffer-overruns-caused-by-bit-glitches-on-the-bus.patch
 smb3-validate-negotiate-request-must-always-be-signed.patch
 cifs-enable-encryption-during-session-setup-phase.patch
+staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch
diff --git a/queue-4.4/staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch b/queue-4.4/staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch
new file mode 100644
index 00000000000..55f159b9edd
--- /dev/null
+++ b/queue-4.4/staging-android-ashmem-fix-possible-deadlock-in-ashmem_ioctl.patch
@@ -0,0 +1,56 @@
+From 740a5759bf222332fbb5eda42f89aa25ba38f9b2 Mon Sep 17 00:00:00 2001
+From: Yisheng Xie <xieyisheng1@huawei.com>
+Date: Wed, 28 Feb 2018 14:59:22 +0800
+Subject: staging: android: ashmem: Fix possible deadlock in ashmem_ioctl
+
+From: Yisheng Xie <xieyisheng1@huawei.com>
+
+commit 740a5759bf222332fbb5eda42f89aa25ba38f9b2 upstream.
+
+ashmem_mutex may create a chain of dependencies like:
+
+CPU0                                    CPU1
+ mmap syscall                           ioctl syscall
+ -> mmap_sem (acquired)                 -> ashmem_ioctl
+ -> ashmem_mmap                            -> ashmem_mutex (acquired)
+    -> ashmem_mutex (try to acquire)       -> copy_from_user
+                                              -> mmap_sem (try to acquire)
+
+There is a lock odering problem between mmap_sem and ashmem_mutex causing
+a lockdep splat[1] during a syzcaller test. This patch fixes the problem
+by move copy_from_user out of ashmem_mutex.
+
+[1] https://www.spinics.net/lists/kernel/msg2733200.html
+
+Fixes: ce8a3a9e76d0 (staging: android: ashmem: Fix a race condition in pin ioctls)
+Reported-by: syzbot+d7a918a7a8e1c952bc36@syzkaller.appspotmail.com
+Signed-off-by: Yisheng Xie <xieyisheng1@huawei.com>
+Cc: "Joel Fernandes (Google)" <joel.opensrc@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/staging/android/ashmem.c |    8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -703,16 +703,14 @@ static int ashmem_pin_unpin(struct ashme
+ 	size_t pgstart, pgend;
+ 	int ret = -EINVAL;
+ 
++	if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
++		return -EFAULT;
++
+ 	mutex_lock(&ashmem_mutex);
+ 
+ 	if (unlikely(!asma->file))
+ 		goto out_unlock;
+ 
+-	if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
+-		ret = -EFAULT;
+-		goto out_unlock;
+-	}
+-
+ 	/* per custom, you can pass zero for len to mean "everything onward" */
+ 	if (!pin.len)
+ 		pin.len = PAGE_ALIGN(asma->size) - pin.offset;