diff options
| author | Jann Horn <jannh@google.com> | 2016-06-16 00:45:33 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-08-15 16:59:23 +0200 |
| commit | 7b142d8fd0bd4c9bf06ccb72ac4daedb503f0124 (patch) | |
| tree | bf9d3363c73c6de066152384b4608a259bd473e0 | |
| parent | 7ef9153d9af5fe7ce32dcc0f558bfcfc3d2b3016 (diff) | |
| download | op-kernel-dev-7b142d8fd0bd4c9bf06ccb72ac4daedb503f0124.zip op-kernel-dev-7b142d8fd0bd4c9bf06ccb72ac4daedb503f0124.tar.gz | |
android: binder: fix dangling pointer comparison
If /dev/binder is opened and the opener process then e.g. calls execve,
proc->vma_vm_mm will still point to the location of the now-freed
mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling
proc->vma_vm_mm pointer will be compared to current->mm.
Let the binder take a reference to the mm_struct to avoid this.
v2: use the right refcounter
Fixes: a906d6931f3c ("android: binder: Sanity check at binder ioctl")
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Chen Feng <puck.chen@hisilicon.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/android/binder.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 16288e7..09fdb42 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2962,6 +2962,7 @@ static int binder_open(struct inode *nodp, struct file *filp) return -ENOMEM; get_task_struct(current); proc->tsk = current; + atomic_inc(¤t->mm->mm_count); proc->vma_vm_mm = current->mm; INIT_LIST_HEAD(&proc->todo); init_waitqueue_head(&proc->wait); @@ -3167,6 +3168,7 @@ static void binder_deferred_release(struct binder_proc *proc) vfree(proc->buffer); } + mmdrop(proc->vma_vm_mm); put_task_struct(proc->tsk); binder_debug(BINDER_DEBUG_OPEN_CLOSE, |
