All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <gregkh@linuxfoundation.org>
To: Martijn Coenen <maco@android.com>
Cc: john.stultz@linaro.org, tkjos@google.com, arve@android.com,
	linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org,
	maco@google.com, ebiggers@google.com
Subject: Re: [PATCH] ANDROID: binder: remove waitqueue when thread exits.
Date: Fri, 5 Jan 2018 13:20:21 +0100	[thread overview]
Message-ID: <20180105122021.GF19551@kroah.com> (raw)
In-Reply-To: <20180105102707.261740-1-maco@android.com>

On Fri, Jan 05, 2018 at 11:27:07AM +0100, Martijn Coenen wrote:
> binder_poll() passes the thread->wait waitqueue that
> can be slept on for work. When a thread that uses
> epoll explicitly exits using BINDER_THREAD_EXIT,
> the waitqueue is freed, but it is never removed
> from the corresponding epoll data structure. When
> the process subsequently exits, the epoll cleanup
> code tries to access the waitlist, which results in
> a use-after-free.
> 
> Prevent this by using POLLFREE when the thread exits.
> 
> Signed-off-by: Martijn Coenen <maco@android.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>
> ---
>  drivers/android/binder.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)

Should this be a 4.15-final thing, as well as backported to any range of
older kernels?

thanks,

greg k-h

  reply	other threads:[~2018-01-05 12:20 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-05 10:27 [PATCH] ANDROID: binder: remove waitqueue when thread exits Martijn Coenen
2018-01-05 12:20 ` Greg KH [this message]
2018-01-05 12:54   ` Martijn Coenen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180105122021.GF19551@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=arve@android.com \
    --cc=devel@driverdev.osuosl.org \
    --cc=ebiggers@google.com \
    --cc=john.stultz@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maco@android.com \
    --cc=maco@google.com \
    --cc=tkjos@google.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.