p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

android: binder: fix dangling pointer comparison 

If /dev/binder is opened and the opener process then e.g. calls execve,
proc->vma_vm_mm will still point to the location of the now-freed
mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling
proc->vma_vm_mm pointer will be compared to current->mm.

Let the binder take a reference to the mm_struct to avoid this.

v2: use the right refcounter

Fixes: a906d6931f ("android: binder: Sanity check at binder ioctl")
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Chen Feng <puck.chen@hisilicon.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jann Horn 2016-06-16 00:45:33 +02:00 committed by Greg Kroah-Hartman
parent 7ef9153d9a
commit 7b142d8fd0
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/android/binder.c
View File

@ -2962,6 +2962,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
return -ENOMEM;
get_task_struct(current);
proc->tsk = current;
atomic_inc(&current->mm->mm_count);
proc->vma_vm_mm = current->mm;
INIT_LIST_HEAD(&proc->todo);
init_waitqueue_head(&proc->wait);
@ -3167,6 +3168,7 @@ static void binder_deferred_release(struct binder_proc *proc)
vfree(proc->buffer);
}
mmdrop(proc->vma_vm_mm);
put_task_struct(proc->tsk);
binder_debug(BINDER_DEBUG_OPEN_CLOSE,