diff options
| author | Todd Kjos <tkjos@google.com> | 2017-11-10 15:30:27 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-11-16 23:53:41 -0800 |
| commit | 6bfca30de945217d6c053fb3e3251b0567944af9 (patch) | |
| tree | 3ce027554552d400bb27b012a3d01ff50eb511db /lib/mpi/mpi-inline.h | |
| parent | ae2f6cb5ada42a3e3da6182ac3092007f5a319d8 (diff) | |
FROMLIST: binder: fix proc->files use-after-free
(from https://patchwork.kernel.org/patch/10058587/)
proc->files cleanup is initiated by binder_vma_close. Therefore
a reference on the binder_proc is not enough to prevent the
files_struct from being released while the binder_proc still has
a reference. This can lead to an attempt to dereference the
stale pointer obtained from proc->files prior to proc->files
cleanup. This has been seen once in task_get_unused_fd_flags()
when __alloc_fd() is called with a stale "files".
The fix is to always use get_files_struct() to obtain struct_files
so that the refcount on the files_struct is used to prevent
a premature free. proc->files is removed since we get it every
time.
Bug: 69164715
Change-Id: I6431027d3d569e76913935c21885201505627982
Signed-off-by: Todd Kjos <tkjos@google.com>
Git-commit: 1d6b43334b45144beb0dc8236f9eb3b6cf3b2995
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: Kyle Yan <kyan@codeaurora.org>
Diffstat (limited to 'lib/mpi/mpi-inline.h')
0 files changed, 0 insertions, 0 deletions