Daniel Rosenberg 39ff3ef14a ANDROID: ion: Protect kref from userspace manipulation ...

This separates the kref for ion handles into two components.
Userspace requests through the ioctl will hold at most one
reference to the internally used kref. All additional requests
will increment a separate counter, and the original reference is
only put once that counter hits 0. This protects the kernel from
a poorly behaving userspace.

Bug: 34276203

Change-Id: Ibc36bc4405788ed0fea7337b541cad3be2b934c0
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Git-repo: https://android.googlesource.com/kernel/msm/
Git-commit: 20abfcc16884a5af973a5e91dd013ddd789c44f4
[d-cagle@codeaurora.org: Resolve style issues]
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
CVE-2017-0564
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-08 12:19:52 +02:00

..

drm

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

gpu_sysfs

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

ion

ANDROID: ion: Protect kref from userspace manipulation

2019-08-08 12:19:52 +02:00

msm

msm: kgsl: Fix kgsl memory allocation and free race condition

2019-08-06 12:26:41 +02:00

stub

…

vga

Merge tag 'v3.4.113' into lineage-16.0

2019-08-05 14:20:47 +02:00

Makefile

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00