This is a note to let you know that I've just added the patch titled ion: Do not 'put' ION handle until after its final use to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ion-do-not-put-ion-handle-until-after-its-final-use.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Thu Jan 27 04:37:00 PM CET 2022 From: Lee Jones <lee.jones@xxxxxxxxxx> Date: Tue, 25 Jan 2022 14:18:08 +0000 Subject: ion: Do not 'put' ION handle until after its final use To: lee.jones@xxxxxxxxxx Cc: stable@xxxxxxxxxxxxxxx Message-ID: <20220125141808.1172511-3-lee.jones@xxxxxxxxxx> From: Lee Jones <lee.jones@xxxxxxxxxx> pass_to_user() eventually calls kref_put() on an ION handle which is still live, potentially allowing for it to be legitimately freed by the client. Prevent this from happening before its final use in both ION_IOC_ALLOC and ION_IOC_IMPORT. Signed-off-by: Lee Jones <lee.jones@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/staging/android/ion/ion-ioctl.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) --- a/drivers/staging/android/ion/ion-ioctl.c +++ b/drivers/staging/android/ion/ion-ioctl.c @@ -165,10 +165,9 @@ long ion_ioctl(struct file *filp, unsign data.allocation.flags, true); if (IS_ERR(handle)) return PTR_ERR(handle); - pass_to_user(handle); data.allocation.handle = handle->id; - cleanup_handle = handle; + pass_to_user(handle); break; } case ION_IOC_FREE: @@ -212,11 +211,12 @@ long ion_ioctl(struct file *filp, unsign if (IS_ERR(handle)) { ret = PTR_ERR(handle); } else { + data.handle.handle = handle->id; handle = pass_to_user(handle); - if (IS_ERR(handle)) + if (IS_ERR(handle)) { ret = PTR_ERR(handle); - else - data.handle.handle = handle->id; + data.handle.handle = 0; + } } break; } Patches currently in stable-queue which might be from lee.jones@xxxxxxxxxx are queue-4.9/ion-protect-kref-from-userspace-manipulation.patch queue-4.9/ion-do-not-put-ion-handle-until-after-its-final-use.patch queue-4.9/ion-fix-use-after-free-during-ion_ioc_alloc.patch