From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751358AbeAEK1O (ORCPT + 1 other); Fri, 5 Jan 2018 05:27:14 -0500 Received: from mail-wm0-f68.google.com ([74.125.82.68]:45904 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750934AbeAEK1M (ORCPT ); Fri, 5 Jan 2018 05:27:12 -0500 X-Google-Smtp-Source: ACJfBouqc7REolx57wQwqSy3fR+3m4EBJAV8b3FB6O/4PPzBUlW4iUBUBQMx7KRkKsCN37yRe/Q49w== From: Martijn Coenen To: gregkh@linuxfoundation.org, john.stultz@linaro.org, tkjos@google.com, arve@android.com Cc: linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org, maco@google.com, ebiggers@google.com, Martijn Coenen Subject: [PATCH] ANDROID: binder: remove waitqueue when thread exits. Date: Fri, 5 Jan 2018 11:27:07 +0100 Message-Id: <20180105102707.261740-1-maco@android.com> X-Mailer: git-send-email 2.16.0.rc0.223.g4a4ac83678-goog Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits. Signed-off-by: Martijn Coenen Reported-by: syzbot --- drivers/android/binder.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 778caed570c6..26a66da72f02 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -4365,6 +4365,18 @@ static int binder_thread_release(struct binder_proc *proc, if (t) spin_lock(&t->lock); } + + /* + * If this thread used poll, make sure we remove the waitqueue + * from any epoll data structures holding it with POLLFREE. + * waitqueue_active() is safe to use here because we're holding + * the inner lock. + */ + if ((thread->looper & BINDER_LOOPER_STATE_POLL) && + waitqueue_active(&thread->wait)) { + wake_up_poll(&thread->wait, POLLHUP | POLLFREE); + } + binder_inner_proc_unlock(thread->proc); if (send_reply) -- 2.16.0.rc0.223.g4a4ac83678-goog