Todd Kjos
bf0e4f96e4
FROMGIT: binder: fix null deref of proc->context ...
The binder driver makes the assumption proc->context pointer is invariant after
initialization (as documented in the kerneldoc header for struct proc).
However, in commit f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
proc->context is set to NULL during binder_deferred_release().
Another proc was in the middle of setting up a transaction to the dying
process and crashed on a NULL pointer deref on "context" which is a local
set to &proc->context:
new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
Here's the stack:
[ 5237.855435] Call trace:
[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
[ 5237.855451] binder_translate_binder+0x1d0/0x388
[ 5237.855456] binder_transaction+0x2228/0x3730
[ 5237.855461] binder_thread_write+0x640/0x25bc
[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
[ 5237.855471] binder_ioctl+0x30c/0x96c
[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
[ 5237.855488] el0_svc_common+0xb4/0x194
[ 5237.855493] el0_svc_handler+0x74/0x98
[ 5237.855497] el0_svc+0x8/0xc
The fix is to move the kfree of the binder_device to binder_free_proc()
so the binder_device is freed when we know there are no references
remaining on the binder_proc.
Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Signed-off-by: Todd Kjos <tkjos@google.com>
(cherry picked from commit d35d3660e065b69fdb8bf512f3d899f350afce52
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git char-misc-linus)
Bug: 158252621
Change-Id: Iee9547d58b85794af034b78eaab47075f3635f82
2020-06-26 21:22:54 +00:00
ACPI/IORT: Fix PMCG node single ID mapping handling
2020-06-22 09:30:54 +02:00
FROMGIT: binder: fix null deref of proc->context
2020-06-26 21:22:54 +00:00
libata: Use per port sync for detach
2020-06-24 17:50:47 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
bus: sunxi-rsb: Return correct data when mixing 16-bit and 8-bit reads
2020-04-17 10:49:56 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
counter: 104-quad-8: Add lock guards - generic interface
2020-05-02 08:48:44 +02:00
This is the 5.4.47 stable release
2020-06-18 10:05:17 +02:00
cpuidle: Fix three reference count leaks
2020-06-22 09:31:10 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
device-dax: don't leak kernel memory to user space after unloading kmem
2020-05-27 17:46:48 +02:00
PM / devfreq: Add missing locking while setting suspend_freq
2020-05-10 10:31:34 +02:00
This is the 5.4.43 stable release
2020-05-28 12:26:15 +02:00
This is the 5.4.39 stable release
2020-05-06 09:03:32 +02:00
EDAC/amd64: Add AMD family 17h model 60h PCI IDs
2020-06-22 09:31:20 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
fpga: dfl: afu: Corrected error handling levels
2020-06-24 17:50:29 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
Drivers: hv: vmbus: Always handle the VMBus messages on CPU0
2020-06-22 09:31:00 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
coresight: tmc: Fix TMC mode read in tmc_read_prepare_etb()
2020-06-24 17:50:15 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
iio: bmp280: fix compensation of humidity
2020-06-24 17:50:12 +02:00
RDMA/iw_cxgb4: cleanup device debugfs entries on ULD remove
2020-06-24 17:50:33 +02:00
input: i8042 - Remove special PowerPC handling
2020-06-24 17:50:36 +02:00
UPSTREAM: interconnect: Handle memory allocation errors
2020-03-12 14:52:54 +01:00
This is the 5.4.44 stable release
2020-06-04 08:23:35 +02:00
ipack: tpci200: fix error return code in tpci200_register()
2020-05-27 17:46:47 +02:00
This is the 5.4.35 stable release
2020-04-23 11:15:10 +02:00
leds: core: Fix warning message when init_data
2020-04-23 10:36:37 +02:00
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-22 09:31:22 +02:00
mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe()
2020-06-24 17:50:36 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
NFC: st21nfca: add missed kfree_skb() in an error path
2020-06-10 20:24:54 +02:00
NTB: perf: Fix race condition when run with ntb_test
2020-06-24 17:50:41 +02:00
libnvdimm: Out of bounds read in __nd_ioctl()
2020-04-23 10:36:42 +02:00
nvme-pci: use simple suspend when a HMB is enabled
2020-06-24 17:50:43 +02:00
This is the 5.4.46 stable release
2020-06-11 09:14:42 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
drivers/perf: hisi: Fix wrong value for all counters enable
2020-06-24 17:50:41 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
platform/x86: asus_wmi: Reserve more space for struct bias_args
2020-06-22 09:31:11 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 17:46:48 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use
2020-06-24 17:50:13 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
s390/qdio: put thinint indicator after early error
2020-06-24 17:50:22 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
slimbus: ngd: get drvdata from correct device
2020-06-24 17:50:22 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
soundwire: slave: don't init debugfs on device registration error
2020-06-24 17:50:23 +02:00
This is the 5.4.48 stable release
2020-06-22 11:43:59 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd()
2020-06-24 17:50:34 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
vfio/mdev: Fix reference count leak in add_mdev_supported_type
2020-06-24 17:50:36 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.49 stable release
2020-06-25 07:49:21 +02:00
This is the 5.4.26 stable release
2020-03-18 08:19:15 +01:00
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-22 09:31:26 +02:00
watchdog: da9062: No need to ping manually before setting timeout
2020-06-24 17:50:32 +02:00
xen/pvcalls-back: test for errors when calling backend_connect()
2020-06-17 16:40:38 +02:00
UPSTREAM: gpu/trace: add a gpu total memory usage tracepoint
2020-04-22 16:10:37 +00:00
bf0e4f96e4