Carlos Llamas 6696f76c32 binder: fix race between mmput() and do_exit() ... commit 9a9ab0d963 upstream. Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A. Task A | Task B ------------------+------------------ mmget_not_zero() | | do_exit() | exit_mm() | mmput() mmput() | exit_mmap() | remove_vma() | fput() | In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead). This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then. In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A. Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-01-25 15:27:39 -08:00
..
Kconfig	remove CONFIG_ANDROID	2022-07-01 10:41:09 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
binder.c	binder: use EPOLLERR from eventpoll.h	2024-01-20 11:50:10 +01:00
binder_alloc.c	binder: fix race between mmput() and do_exit()	2024-01-25 15:27:39 -08:00
binder_alloc.h	binder: fix memory leak in binder_init()	2023-08-16 18:27:24 +02:00
binder_alloc_selftest.c	Revert "android: binder: stop saving a pointer to the VMA"	2023-05-30 14:03:19 +01:00
binder_internal.h	binder: fix redefinition of seq_file attributes	2022-07-08 15:44:19 +02:00
binder_trace.h	Binder: add TF_UPDATE_TXN to replace outdated txn	2022-06-27 16:16:30 +02:00
binderfs.c	binderfs: rework superblock destruction	2022-09-01 16:18:49 +02:00