linux/drivers/android
Todd Kjos 5cec2d2e58 binder: fix race between munmap() and direct reclaim
An munmap() on a binder device causes binder_vma_close() to be called
which clears the alloc->vma pointer.

If direct reclaim causes binder_alloc_free_page() to be called, there
is a race where alloc->vma is read into a local vma pointer and then
used later after the mm->mmap_sem is acquired. This can result in
calling zap_page_range() with an invalid vma which manifests as a
use-after-free in zap_page_range().

The fix is to check alloc->vma after acquiring the mmap_sem (which we
were acquiring anyway) and skip zap_page_range() if it has changed
to NULL.

Signed-off-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-21 06:51:32 +01:00
..
Kconfig binder: add functions to copy to/from binder buffers 2019-02-12 10:43:57 +01:00
Makefile binder: implement binderfs 2018-12-19 09:40:13 +01:00
binder.c binder: fix BUG_ON found by selinux-testsuite 2019-03-21 06:50:47 +01:00
binder_alloc.c binder: fix race between munmap() and direct reclaim 2019-03-21 06:51:32 +01:00
binder_alloc.h binder: use userspace pointer as base of buffer space 2019-02-12 10:43:57 +01:00
binder_alloc_selftest.c binder: fix sparse issue in binder_alloc_selftest.c 2019-02-14 08:13:56 +01:00
binder_internal.h binderfs: remove separate device_initcall() 2019-02-01 15:50:26 +01:00
binder_trace.h binder: use userspace pointer as base of buffer space 2019-02-12 10:43:57 +01:00
binderfs.c binderfs: remove separate device_initcall() 2019-02-01 15:50:26 +01:00