]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
staging: android: ashmem: Disallow ashmem memory from being remapped
authorSuren Baghdasaryan <surenb@google.com>
Mon, 27 Jan 2020 23:56:16 +0000 (15:56 -0800)
committerKleber Sacilotto de Souza <kleber.souza@canonical.com>
Tue, 7 Apr 2020 08:50:30 +0000 (10:50 +0200)
commitbc4c4c49300969086e5e9c8802e69f9e0ebcbbc0
tree8f8ead0f44cb38881f78fce4e1bea7674a87012c
parent043ce76f9c263ee6e16f508ae74cffc1524c4cad
staging: android: ashmem: Disallow ashmem memory from being remapped

BugLink: https://bugs.launchpad.net/bugs/1867837
commit 6d67b0290b4b84c477e6a2fc6e005e174d3c7786 upstream.

When ashmem file is mmapped, the resulting vma->vm_file points to the
backing shmem file with the generic fops that do not check ashmem
permissions like fops of ashmem do. If an mremap is done on the ashmem
region, then the permission checks will be skipped. Fix that by disallowing
mapping operation on the backing shmem file.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Cc: stable <stable@vger.kernel.org> # 4.4,4.9,4.14,4.18,5.4
Signed-off-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Link: https://lore.kernel.org/r/20200127235616.48920-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
drivers/staging/android/ashmem.c