Todd Kjos
7f3dc0088b
binder: fix proc->files use-after-free ...
proc->files cleanup is initiated by binder_vma_close. Therefore
a reference on the binder_proc is not enough to prevent the
files_struct from being released while the binder_proc still has
a reference. This can lead to an attempt to dereference the
stale pointer obtained from proc->files prior to proc->files
cleanup. This has been seen once in task_get_unused_fd_flags()
when __alloc_fd() is called with a stale "files".
The fix is to protect proc->files with a mutex to prevent cleanup
while in use.
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org> # 4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-12-18 15:47:12 +01:00
2017-11-02 11:10:55 +01:00
2017-12-05 23:25:49 +01:00
2017-11-14 16:54:12 -08:00
2017-12-18 15:47:12 +01:00
2017-11-15 14:11:41 -08:00
2017-11-29 13:10:25 -08:00
2017-11-27 12:36:45 -08:00
2017-12-08 09:58:10 -08:00
2017-11-15 11:56:19 -08:00
2017-12-01 08:05:45 -05:00
2017-11-04 09:26:51 +09:00
2017-12-04 17:15:20 +00:00
2017-11-14 15:32:19 -08:00
2017-11-26 14:11:54 -08:00
2017-11-17 20:04:24 -08:00
2017-11-23 16:29:05 +01:00
2017-10-22 02:22:39 +01:00
2017-11-22 00:00:14 +01:00
2017-11-16 12:47:46 -08:00
2017-11-16 12:47:46 -08:00
2017-11-29 18:40:42 -08:00
2017-11-13 01:41:39 +01:00
2017-11-02 11:10:55 +01:00
2017-11-14 16:49:31 -08:00
2017-11-17 14:58:01 -08:00
2017-11-15 13:46:33 -08:00
2017-11-02 11:10:55 +01:00
2017-11-13 21:14:07 -08:00
2017-11-13 17:56:58 -08:00
2017-12-10 08:26:59 -08:00
2017-11-02 11:10:55 +01:00
2017-11-16 09:10:59 -08:00
2017-12-02 22:41:43 +01:00
2017-12-08 08:17:53 +10:00
2017-11-21 15:57:07 -08:00
2017-11-15 13:35:43 -08:00
2017-12-18 15:47:12 +01:00
2017-11-30 13:12:44 -08:00
2017-11-17 20:16:20 -08:00
2017-11-16 09:10:59 -08:00
2017-11-27 19:14:29 +01:00
2017-11-19 08:04:41 -10:00
2017-11-13 01:34:14 +01:00
2017-12-02 11:15:14 +00:00
2017-12-05 10:10:15 -08:00
2017-11-21 16:35:54 -08:00
2017-12-06 10:53:02 -08:00
2017-11-26 14:39:20 -08:00
2017-11-21 15:57:09 -08:00
2017-11-14 18:09:31 -08:00
2017-11-21 15:46:44 -08:00
2017-11-13 17:56:58 -08:00
2017-11-15 13:39:18 -08:00
2017-11-02 11:10:55 +01:00
2017-12-01 12:19:48 -08:00
2017-12-08 13:18:47 -08:00
2017-11-16 16:05:01 -08:00
2017-11-21 15:57:07 -08:00
2017-11-15 13:46:33 -08:00
2017-11-21 15:57:07 -08:00
2017-12-03 10:48:24 -05:00
2017-12-01 08:14:22 -05:00
2017-11-27 13:05:09 -08:00
2017-12-08 13:32:44 -08:00
2017-11-21 15:57:09 -08:00
2017-11-21 15:57:07 -08:00
2017-11-13 12:10:24 -08:00
2017-11-17 09:51:57 -08:00
2017-11-28 08:49:26 -08:00
2017-11-16 09:10:59 -08:00
2017-12-08 09:32:18 -06:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-16 09:10:59 -08:00
2017-11-26 14:11:54 -08:00
2017-11-17 16:10:04 -08:00
2017-11-15 10:56:56 -08:00
2017-11-13 21:14:07 -08:00
2017-11-30 16:50:43 +01:00
2017-11-25 08:37:16 -10:00
2017-11-02 11:10:55 +01:00
2017-11-15 13:37:15 -08:00
2017-11-21 15:57:07 -08:00
2017-11-16 13:06:27 -08:00
2017-11-22 21:09:18 -10:00
2017-11-17 16:56:17 -08:00
2017-11-13 17:56:58 -08:00
2017-11-16 09:15:57 -08:00
2017-11-17 20:14:10 -08:00
2017-11-16 16:05:01 -08:00
2017-11-17 20:12:08 -08:00
2017-11-25 08:37:16 -10:00
2017-12-05 07:51:09 +01:00
2017-11-17 20:21:44 -08:00
2017-12-05 10:31:32 -08:00
2017-11-14 16:54:12 -08:00
2017-11-30 15:29:44 -08:00
2017-11-10 21:33:51 +00:00
2017-11-02 11:10:55 +01:00
2017-12-08 13:32:44 -08:00
2017-11-25 08:37:16 -10:00
2017-11-29 10:24:57 +01:00
2017-11-17 14:31:27 -08:00
2017-12-16 16:37:51 +01:00
2017-11-28 16:00:50 +01:00
2017-11-02 11:10:55 +01:00
2017-12-01 15:24:59 +00:00
2017-11-21 15:57:07 -08:00
2017-11-14 16:47:47 -08:00
2017-12-02 21:31:03 -05:00
2017-11-20 21:50:24 -10:00
2017-12-07 18:30:50 +02:00
2017-11-16 09:10:59 -08:00
2017-11-16 09:10:59 -08:00
2017-11-21 15:57:07 -08:00
2017-12-08 12:53:43 -08:00
2017-11-02 11:10:55 +01:00
2017-11-13 01:40:52 +01:00
2017-11-28 15:17:49 +01:00
7f3dc0088b