[PATCH v3] binder: add mutex_lock for mmap and NULL when free

Kassey Li
2023-10-07T12:28:40Z

- Enforce alloc->mutex in binder_alloc_mmap_handler when add the entry to
list.

- Assign the freed pages/page_ptr to NULL to catch possible use after free
with NULL pointer access.

Fixes: 19c987241ca1 ("binder: separate out binder_alloc functions")
Fixes: f2517eb76f1f ("android: binder: Add global lru shrinker to binder")
CC: Todd Kjos <tkjos@android.com>
CC: Sherry Yang <sherryy@android.com>
Link: https://lore.kernel.org/all/20231007034046.2352124-1-quic_yingangl@quicinc.com/
Signed-off-by: Kassey Li <quic_yingangl@quicinc.com>
---
V1 -> V2: Add Fixes info.
V2 -> V3: Add this history.
---
drivers/android/binder_alloc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index e3db8297095a..c7d126e04343 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -775,6 +775,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
}

buffer->user_data = alloc->buffer;
+ mutex_lock(&alloc->mutex);
list_add(&buffer->entry, &alloc->buffers);
buffer->free = 1;
binder_insert_free_buffer(alloc, buffer);
@@ -782,7 +783,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,

/* Signal binder_alloc is fully initialized */
binder_alloc_set_vma(alloc, vma);
-
+ mutex_unlock(&alloc->mutex);
return 0;

err_alloc_buf_struct_failed:
@@ -856,9 +857,11 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc)
__func__, alloc->pid, i, page_addr,
on_lru ? "on lru" : "active");
__free_page(alloc->pages[i].page_ptr);
+ alloc->pages[i].page_ptr = NULL;
page_count++;
}
kfree(alloc->pages);
+ alloc->pages = NULL;
}
mutex_unlock(&alloc->mutex);
if (alloc->mm)
--
2.25.1