staging: ion: msm: Apply d82ad70 to msm_ion_custom_ioctl

Commit d82ad70 ("staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free") removed the definition of ion_handle_get_by_id, replacing it with a lockless version. Update msm_ion_custom_ioctl with this same definition and scheme. Signed-off-by: Nathan Chancellor <[email protected]>
EAS-Project · Oct 13, 2018 · 0bd7595 · 0bd7595
1 parent 18c3b12
commit 0bd7595
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 5 deletions.
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
@@ -420,8 +420,8 @@ static struct ion_handle *ion_handle_lookup(struct ion_client *client,
 	return ERR_PTR(-EINVAL);
 }
 
-static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
-						int id)
+struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
+					       int id)
 {
 	struct ion_handle *handle;
 

diff --git a/drivers/staging/android/ion/ion_priv.h b/drivers/staging/android/ion/ion_priv.h
@@ -579,8 +579,8 @@ int ion_walk_heaps(struct ion_client *client, int heap_id,
 			enum ion_heap_type type, void *data,
 			int (*f)(struct ion_heap *heap, void *data));
 
-struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
-					int id);
+struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
+					       int id);
 
 int ion_handle_put(struct ion_handle *handle);
 

diff --git a/drivers/staging/android/ion/msm/msm_ion.c b/drivers/staging/android/ion/msm/msm_ion.c
@@ -695,13 +695,16 @@ long msm_ion_custom_ioctl(struct ion_client *client,
 		struct mm_struct *mm = current->active_mm;
 
 		if (data.flush_data.handle > 0) {
-			handle = ion_handle_get_by_id(client,
+			mutex_lock(&client->lock);
+			handle = ion_handle_get_by_id_nolock(client,
 						(int)data.flush_data.handle);
 			if (IS_ERR(handle)) {
+				mutex_unlock(&client->lock);
 				pr_info("%s: Could not find handle: %d\n",
 					__func__, (int)data.flush_data.handle);
 				return PTR_ERR(handle);
 			}
+			mutex_unlock(&client->lock);
 		} else {
 			handle = ion_import_dma_buf(client, data.flush_data.fd);
 			if (IS_ERR(handle)) {