linux-stable/drivers/android
Todd Kjos 7f3dc0088b binder: fix proc->files use-after-free
proc->files cleanup is initiated by binder_vma_close. Therefore
a reference on the binder_proc is not enough to prevent the
files_struct from being released while the binder_proc still has
a reference. This can lead to an attempt to dereference the
stale pointer obtained from proc->files prior to proc->files
cleanup. This has been seen once in task_get_unused_fd_flags()
when __alloc_fd() is called with a stale "files".

The fix is to protect proc->files with a mutex to prevent cleanup
while in use.

Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org> # 4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-18 15:47:12 +01:00
..
binder.c binder: fix proc->files use-after-free 2017-12-18 15:47:12 +01:00
binder_alloc.c Merge 4.14-rc6 into char-misc-next 2017-10-23 17:21:44 +02:00
binder_alloc.h android: binder: Don't get mm from task 2017-10-21 10:14:20 +02:00
binder_alloc_selftest.c android: binder: Add global lru shrinker to binder 2017-08-28 16:47:17 +02:00
binder_trace.h android: binder: Add shrinker tracepoints 2017-08-28 16:47:17 +02:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile android: binder: Add allocator selftest 2017-08-28 16:47:17 +02:00