[PATCH 4.9 33/94] staging: android: ashmem: Fix mmap size validation

Greg Kroah-Hartman gregkh at linuxfoundation.org
Tue Oct 2 13:24:47 UTC 2018


4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Alistair Strachan <astrachan at google.com>

[ Upstream commit 8632c614565d0c5fdde527889601c018e97b6384 ]

The ashmem driver did not check that the size/offset of the vma passed
to its .mmap() function was not larger than the ashmem object being
mapped. This could cause mmap() to succeed, even though accessing parts
of the mapping would later fail with a segmentation fault.

Ensure an error is returned by the ashmem_mmap() function if the vma
size is larger than the ashmem object size. This enables safer handling
of the problem in userspace.

Cc: Todd Kjos <tkjos at android.com>
Cc: devel at driverdev.osuosl.org
Cc: linux-kernel at vger.kernel.org
Cc: kernel-team at android.com
Cc: Joel Fernandes <joel at joelfernandes.org>
Signed-off-by: Alistair Strachan <astrachan at google.com>
Acked-by: Joel Fernandes (Google) <joel at joelfernandes.org>
Reviewed-by: Martijn Coenen <maco at android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
Signed-off-by: Sasha Levin <alexander.levin at microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 drivers/staging/android/ashmem.c |    6 ++++++
 1 file changed, 6 insertions(+)

--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -383,6 +383,12 @@ static int ashmem_mmap(struct file *file
 		goto out;
 	}
 
+	/* requested mapping size larger than object size */
+	if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
+		ret = -EINVAL;
+		goto out;
+	}
+
 	/* requested protection bits must match our allowed protection mask */
 	if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
 		     calc_vm_prot_bits(PROT_MASK, 0))) {




More information about the devel mailing list