From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-4177934-1517382776-2-10704477581740945853 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no ("Email failed DMARC policy for domain") X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, FREEMAIL_FORGED_FROMDOMAIN 0.195, FREEMAIL_FROM 0.001, HEADER_FROM_DIFFERENT_DOMAINS 0.001, RCVD_IN_DNSWL_MED -2.3, SPF_PASS -0.001, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='140.211.166.137', Host='smtp4.osuosl.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: to='UTF-8', plain='us-ascii' X-IgnoreVacation: yes ("Email failed DMARC policy for domain") X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: driverdev-devel-bounces@linuxdriverproject.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1517382775; b=aJ+OFxt6/vr4yvRpiO/zO1LnBCw9kEMiyrMPElrWv3Jhq/R xLX4/6ZJBQAnQulnTuV/dJ/kec/pN7seK0X+Y7zfXe4/f8LEHUrLzGjDOyLPLDfM tdG7zzL1IvnkIVbIixtDokAHSdg2Dzplb4M81UcLR8I7QP8xdGLgxhleYhn6TWMT QgLLi37lUpTN6/EKRKEqQcAHdSVjN6Foj6wxDRSlYG/cwrPica96hwIfs6wG/blQ nnATkGPnBAOsYt7kq7q2F3FTMfxdsf7f55yRNOM0BsRP3xkWruylvp7R97wD32a4 vzSk0MUfuJBYZ7iyFEyUBlAxo6+qcx76XYB7Auw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:subject:date:message-id :in-reply-to:references:list-id:list-unsubscribe:list-archive :list-post:list-help:list-subscribe:cc:mime-version:content-type :content-transfer-encoding:sender; s=arctest; t=1517382775; bh=o yKfabUtqlEelYtW03rmCArVmUWEfRvAqtCjEDGSDhw=; b=s+2Ih5uNS2T7pQKox xVcNyV/iOVlZEwKu4aIek0vycdsQr1sYXIYPxi9d4tLVPrQgztkQvPG8hFWVO0cA 9cMZ6TvrKxntB15uYaQG9JDDDl46hkHMJpuQtHizWKw/RhB5RiPr9CIfTS636DeN NVCst743YaEm6F/UbIbpTCD4UUk9yPLTGmPv16gPrbKgS0N8dTTvuggn0H2naTN1 9RJCOTemA4hU1OIgOPA15jNmYs5yOXLPNnpjhMbIzEmlK+tkMLDKDzZlJUgIZBTo RTwgcL0HS5/YQpV+/CHP3+g3iTI+EeUeSkaMecPrACfJaxGpKhVfVt8HYYmHfC0c 4Sn1g== ARC-Authentication-Results: i=1; mx3.messagingengine.com; arc=none (no signatures found); dkim=fail (message has been altered; 2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=Y5M0uoBJ x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=fail (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=140.211.166.137 (smtp4.osuosl.org); spf=pass smtp.mailfrom=driverdev-devel-bounces@linuxdriverproject.org smtp.helo=fraxinus.osuosl.org; x-aligned-from=fail; x-google-dkim=fail (message has been altered; 2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=WPC0gBeP; x-ptr=fail x-ptr-helo=fraxinus.osuosl.org x-ptr-lookup=smtp4.osuosl.org; x-return-mx=pass smtp.domain=linuxdriverproject.org smtp.result=pass smtp_is_org_domain=yes header.domain=gmail.com header.result=pass header_is_org_domain=yes; x-tls=pass version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128 Authentication-Results: mx3.messagingengine.com; arc=none (no signatures found); dkim=fail (message has been altered; 2048-bit rsa key sha256) header.d=gmail.com header.i=@gmail.com header.b=Y5M0uoBJ x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20161025; dmarc=fail (p=none,has-list-id=yes,d=none) header.from=gmail.com; iprev=pass policy.iprev=140.211.166.137 (smtp4.osuosl.org); spf=pass smtp.mailfrom=driverdev-devel-bounces@linuxdriverproject.org smtp.helo=fraxinus.osuosl.org; x-aligned-from=fail; x-google-dkim=fail (message has been altered; 2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=WPC0gBeP; x-ptr=fail x-ptr-helo=fraxinus.osuosl.org x-ptr-lookup=smtp4.osuosl.org; x-return-mx=pass smtp.domain=linuxdriverproject.org smtp.result=pass smtp_is_org_domain=yes header.domain=gmail.com header.result=pass header_is_org_domain=yes; x-tls=pass version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128 X-Remote-Delivered-To: driverdev-devel@osuosl.org X-Google-Smtp-Source: AH8x224FamzEtCbfkGpN3CwR4kc65b0g1/88i4IiP/Kq7zV8el3Ft04gd64ohe99WggVjp46WJiKCA== From: Eric Biggers To: Greg Kroah-Hartman , =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= , Todd Kjos , Martijn Coenen Subject: [PATCH] binder: check for binder_thread allocation failure in binder_poll() Date: Tue, 30 Jan 2018 23:11:24 -0800 Message-Id: <20180131071124.3214-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.16.1 In-Reply-To: <001a1141f0503ddaa4055f6f8079@google.com> References: <001a1141f0503ddaa4055f6f8079@google.com> X-BeenThere: driverdev-devel@linuxdriverproject.org X-Mailman-Version: 2.1.24 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: devel@driverdev.osuosl.org, syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org, Eric Biggers MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: driverdev-devel-bounces@linuxdriverproject.org Sender: "devel" X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Eric Biggers If the kzalloc() in binder_get_thread() fails, binder_poll() dereferences the resulting NULL pointer. Fix it by returning POLLERR if the memory allocation failed. This bug was found by syzkaller using fault injection. Reported-by: syzbot Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers --- drivers/android/binder.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d21040c5d343f..326ca8ea9ebcf 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -4391,6 +4391,8 @@ static __poll_t binder_poll(struct file *filp, bool wait_for_proc_work; thread = binder_get_thread(proc); + if (!thread) + return POLLERR; binder_inner_proc_lock(thread->proc); thread->looper |= BINDER_LOOPER_STATE_POLL; -- 2.16.1 _______________________________________________ devel mailing list devel@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel