Todd Kjos
8d3d29f072
UPSTREAM: binder: fix UAF when releasing todo list ...
When releasing a thread todo list when tearing down
a binder_proc, the following race was possible which
could result in a use-after-free:
1. Thread 1: enter binder_release_work from binder_thread_release
2. Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked()
3. Thread 2: dec nodeA --> 0 (will free node)
4. Thread 1: ACQ inner_proc_lock
5. Thread 2: block on inner_proc_lock
6. Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA)
7. Thread 1: REL inner_proc_lock
8. Thread 2: ACQ inner_proc_lock
9. Thread 2: todo list cleanup, but work was already dequeued
10. Thread 2: free node
11. Thread 2: REL inner_proc_lock
12. Thread 1: deref w->type (UAF)
The problem was that for a BINDER_WORK_NODE, the binder_work element
must not be accessed after releasing the inner_proc_lock while
processing the todo list elements since another thread might be
handling a deref on the node containing the binder_work element
leading to the node being freed.
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com
Cc: <stable@vger.kernel.org> # 4.14, 4.19, 5.4, 5.8
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f3277cbfba763cd2826396521b9296de67cf1bbc)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7c1bf0b74824f272664e76206c5dc3b66b9eeaff
2020-10-17 13:13:17 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
UPSTREAM: amba: Retry adding deferred devices at late_initcall
2020-06-27 01:02:29 +00:00
UPSTREAM: binder: fix UAF when releasing todo list
2020-10-17 13:13:17 +02:00
ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
2020-06-30 15:37:03 -04:00
atm: fix atm_dev refcnt leaks in atmtcp_remove_persistent
2020-08-11 15:33:38 +02:00
ANDROID: sched: add cpumask parameter to cpu capacity vendor hook
2020-09-28 16:04:11 +00:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
bus: ti-sysc: Add missing quirk flags for usb_host_hs
2020-08-19 08:16:00 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
FROMLIST: clk: sunxi-ng: add support for the Allwinner A100 CCU
2020-08-27 17:11:05 +08:00
ANDROID: GKI: enable CONFIG_MTK_TIMER
2020-08-28 22:28:50 +00:00
counter: 104-quad-8: Add lock guards - generic interface
2020-05-02 08:48:44 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
ANDROID: adding __nocfi to cpuidle_enter_state
2020-10-08 12:58:32 +00:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
device-dax: don't leak kernel memory to user space after unloading kmem
2020-05-27 17:46:48 +02:00
PM / devfreq: Add missing locking while setting suspend_freq
2020-05-10 10:31:34 +02:00
This is the 5.4.54 stable release
2020-07-29 13:27:01 +02:00
This is the 5.4.54 stable release
2020-07-29 13:27:01 +02:00
EDAC: Fix reference count leaks
2020-08-19 08:15:54 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
fpga: dfl: fix bug in port reset handshake
2020-07-29 10:18:31 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
This is the 5.4.54 stable release
2020-07-29 13:27:01 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
Drivers: hv: vmbus: Ignore CHANNELMSG_TL_CONNECT_RESULT(23)
2020-08-11 15:33:38 +02:00
This is the 5.4.54 stable release
2020-07-29 13:27:01 +02:00
coresight: tmc: Fix TMC mode read in tmc_read_unprepare_etb()
2020-08-19 08:16:14 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
BACKPORT: FROMLIST: cpuidle: change enter_s2idle() prototype
2020-07-29 14:37:49 +00:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
RDMA/bnxt_re: Do not add user qps to flushlist
2020-08-26 10:41:05 +02:00
Revert "ANDROID: vendor_hooks: Add vendor hooks for key combination"
2020-09-11 11:47:54 +09:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
ipack: tpci200: fix error return code in tpci200_register()
2020-05-27 17:46:47 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
leds: core: Flush scheduled work for system suspend
2020-08-19 08:16:11 +02:00
macintosh/via-macii: Access autopoll_devs when inside lock
2020-08-19 08:16:15 +02:00
mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe()
2020-06-24 17:50:36 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
scsi: mptscsih: Fix read sense data size
2020-07-16 08:16:36 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
ANDROID: lkdtm/usercopy: Use __va_function to find proper vm_mmap address
2020-09-15 13:01:00 -07:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
2020-08-05 09:59:50 +02:00
NTB: perf: Fix race condition when run with ntb_test
2020-06-24 17:50:41 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths
2020-08-19 08:15:59 +02:00
This is the 5.4.46 stable release
2020-06-11 09:14:42 +02:00
UPSTREAM: of: property: Add device link support for pinctrl-0 through pinctrl-8
2020-08-06 19:53:54 -07:00
opp: Enable resources again if they were disabled earlier
2020-08-26 10:40:53 +02:00
parisc: mask out enable and reserved bits from sba imask
2020-08-19 08:16:26 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
drivers/perf: Prevent forced unbinding of PMU drivers
2020-07-29 10:18:40 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
FROMLIST: pinctrl: sunxi: add support for the Allwinner A100 pin controller
2020-08-27 17:09:29 +08:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
FROMLIST: power: supply: core: property to control reverse charge
2020-09-01 17:57:03 +00:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 17:46:48 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
FROMLIST: rpmsg: Guard against null endpoint ops in destroy
2020-08-07 12:03:00 +00:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
scsi: zfcp: Fix use-after-free in request timeout handlers
2020-08-26 10:40:52 +02:00
UPSTREAM: scsi: ufs: ufs-mediatek: Modify the minimum RX/TX lane count to 2
2020-08-28 20:54:00 +00:00
This is the 5.4.53 stable release
2020-07-23 12:36:54 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
soundwire: intel: fix memory leak with devm_kasprintf
2020-07-22 09:33:00 +02:00
UPSTREAM: spi: add power control when set_cs
2020-09-07 10:13:03 +02:00
ANDROID: ion: export some ion symbols
2020-08-27 21:06:34 +00:00
scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
2020-08-26 10:40:54 +02:00
This is the 5.4.59 stable release
2020-08-19 08:40:57 +02:00
ANDROID: sysrq: add vendor hook for sysrq crash information
2020-10-13 14:46:48 +09:00
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:33:13 +02:00
UPSTREAM: ehci-hcd: Move include to keep CRC stable
2020-10-15 17:21:03 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
This is the 5.4.56 stable release
2020-08-05 11:19:16 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
virt: vbox: Fix guest capabilities mask check
2020-07-22 09:33:11 +02:00
This is the 5.4.61 stable release
2020-08-26 11:11:38 +02:00
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-22 09:31:26 +02:00
Revert "ANDROID: Revert: Merge 5.4.60 into android11-5.4"
2020-08-23 13:12:51 +02:00
xen: don't reschedule in preemption off sections
2020-08-26 10:41:07 +02:00
8d3d29f072