Todd Kjos c2a035d782 binder: fix race between munmap() and direct reclaim ... commit 5cec2d2e58 upstream. An munmap() on a binder device causes binder_vma_close() to be called which clears the alloc->vma pointer. If direct reclaim causes binder_alloc_free_page() to be called, there is a race where alloc->vma is read into a local vma pointer and then used later after the mm->mmap_sem is acquired. This can result in calling zap_page_range() with an invalid vma which manifests as a use-after-free in zap_page_range(). The fix is to check alloc->vma after acquiring the mmap_sem (which we were acquiring anyway) and skip zap_page_range() if it has changed to NULL. Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Todd Kjos <tkjos@google.com> Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-06-09 09:18:20 +02:00
..
binder.c	binder: fix race that allows malicious free of live buffer	2018-12-05 19:41:26 +01:00
binder_alloc.c	binder: fix race between munmap() and direct reclaim	2019-06-09 09:18:20 +02:00
binder_alloc.h	binder: fix race that allows malicious free of live buffer	2018-12-05 19:41:26 +01:00
binder_alloc_selftest.c	android: binder: Add global lru shrinker to binder	2017-08-28 16:47:17 +02:00
binder_trace.h	android: binder: Add shrinker tracepoints	2017-08-28 16:47:17 +02:00
Kconfig	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Makefile	android: binder: Add allocator selftest	2017-08-28 16:47:17 +02:00