Liam R. Howlett 925e6b6f82 android: binder: stop saving a pointer to the VMA ... [ Upstream commit a43cfc87ca ] Do not record a pointer to a VMA outside of the mmap_lock for later use. This is unsafe and there are a number of failure paths *after* the recorded VMA pointer may be freed during setup. There is no callback to the driver to clear the saved pointer from generic mm code. Furthermore, the VMA pointer may become stale if any number of VMA operations end up freeing the VMA so saving it was fragile to being with. Instead, change the binder_alloc struct to record the start address of the VMA and use vma_lookup() to get the vma when needed. Add lockdep mmap_lock checks on updates to the vma pointer to ensure the lock is held and depend on that lock for synchronization of readers and writers - which was already the case anyways, so the smp_wmb()/smp_rmb() was not necessary. [akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c] Link: https://lkml.kernel.org/r/20220621140212.vpkio64idahetbyf@revolver Fixes: da1b9564e8 ("android: binder: fix the race mmap and alloc_new_buf_locked") Reported-by: syzbot+58b51ac2b04e388ab7b0@syzkaller.appspotmail.com Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Minchan Kim <minchan@kernel.org> Cc: Christian Brauner (Microsoft) <brauner@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hridya Valsaraju <hridya@google.com> Cc: Joel Fernandes <joel@joelfernandes.org> Cc: Martijn Coenen <maco@android.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Todd Kjos <tkjos@android.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-08-17 14:41:55 +02:00
..
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
binder.c	binder: fix redefinition of seq_file attributes	2022-08-17 14:41:45 +02:00
binder_alloc.c	android: binder: stop saving a pointer to the VMA	2022-08-17 14:41:55 +02:00
binder_alloc.h	android: binder: stop saving a pointer to the VMA	2022-08-17 14:41:55 +02:00
binder_alloc_selftest.c	android: binder: stop saving a pointer to the VMA	2022-08-17 14:41:55 +02:00
binder_internal.h	binder: fix redefinition of seq_file attributes	2022-08-17 14:41:45 +02:00
binder_trace.h	binder: add trace at free transaction.	2020-11-11 08:20:44 +01:00
binderfs.c	binder: fix redefinition of seq_file attributes	2022-08-17 14:41:45 +02:00