From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4E275C43613 for ; Sun, 23 Jun 2019 07:23:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1557B208CA for ; Sun, 23 Jun 2019 07:23:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561274604; bh=rTKaUw2AGKqIyGR4cEwrh+IFf4FEdCDbh89qLxWH/6s=; h=Subject:To:From:Date:List-ID:From; b=QCx+jCg5pkyPkRCdAXqNd9tieJclJ3/Lu5Sm3aDG0F1hbbOr3bznB4tAEm94tz/fV dT3Q3HDsxNpQ4NHhEFsBUi4lOTSMX9/w9IkzoSDZQDQfWipotp38NRpB1IRjhvOO3x Caej9IdF+FrZCoOY4Kaop2i55YVRHPAbSCs+KHfY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726086AbfFWHXX (ORCPT ); Sun, 23 Jun 2019 03:23:23 -0400 Received: from mail.kernel.org ([198.145.29.99]:46512 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725268AbfFWHXX (ORCPT ); Sun, 23 Jun 2019 03:23:23 -0400 Received: from localhost (li1825-44.members.linode.com [172.104.248.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F09342073F; Sun, 23 Jun 2019 07:23:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561274602; bh=rTKaUw2AGKqIyGR4cEwrh+IFf4FEdCDbh89qLxWH/6s=; h=Subject:To:From:Date:From; b=aEfJxoXAJtjZlTz07+3RIbSwVt8zQ2jKCeRjMA83TxveG3TE/ZuuJv3WnkExHVcVJ W2FVWkmJ1YKi4mn3EzvB7XU7USaubEN9BlMwqA/CG4oC+yzjclJwFRNbXcIuEmDGCx mEBWuiGzfN7RjIV8D2yn4CRtrwNetiXdybAT7Vwg= Subject: patch "binder: fix memory leak in error path" added to char-misc-next To: tkjos@android.com, gregkh@linuxfoundation.org, stable@vger.kernel.org, tkjos@google.com From: Date: Sun, 23 Jun 2019 09:23:19 +0200 Message-ID: <1561274599154175@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org This is a note to let you know that I've just added the patch titled binder: fix memory leak in error path to my char-misc git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git in the char-misc-next branch. The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.) The patch will also be merged in the next major kernel release during the merge window. If you have any questions about this process, please let me know. >From 1909a671dbc3606685b1daf8b22a16f65ea7edda Mon Sep 17 00:00:00 2001 From: Todd Kjos Date: Fri, 21 Jun 2019 10:54:15 -0700 Subject: binder: fix memory leak in error path syzkallar found a 32-byte memory leak in a rarely executed error case. The transaction complete work item was not freed if put_user() failed when writing the BR_TRANSACTION_COMPLETE to the user command buffer. Fixed by freeing it before put_user() is called. Reported-by: syzbot+182ce46596c3f2e1eb24@syzkaller.appspotmail.com Signed-off-by: Todd Kjos Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 748ac489ef7e..8b108e9b31cc 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -4256,6 +4256,8 @@ static int binder_thread_read(struct binder_proc *proc, case BINDER_WORK_TRANSACTION_COMPLETE: { binder_inner_proc_unlock(proc); cmd = BR_TRANSACTION_COMPLETE; + kfree(w); + binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); if (put_user(cmd, (uint32_t __user *)ptr)) return -EFAULT; ptr += sizeof(uint32_t); @@ -4264,8 +4266,6 @@ static int binder_thread_read(struct binder_proc *proc, binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, "%d:%d BR_TRANSACTION_COMPLETE\n", proc->pid, thread->pid); - kfree(w); - binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); } break; case BINDER_WORK_NODE: { struct binder_node *node = container_of(w, struct binder_node, work); -- 2.22.0