From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1485C4740A for ; Mon, 7 Oct 2019 09:38:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AFC8A21655 for ; Mon, 7 Oct 2019 09:38:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570441104; bh=3zhwfHIcLxbbQ+KpMXuhI+igbeHR1uDpFIhjOQRNKws=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=usex9JOjH9CghxUjuJ2rUBSURzV2+Kb5QOlCcQYkvQ1+69ugEh7Cg/hL1CarfXnCy 015yA613NlHbrZkM9sVFq4/n4bBOQ8H/2gjWN/20510TDmodAZGxmU5O1jPIYi3H7V PDYaiOmlXFsQYrNSepwBnOvnqPy+Z9RSMPpkxDr4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727103AbfJGJiY (ORCPT ); Mon, 7 Oct 2019 05:38:24 -0400 Received: from mail.kernel.org ([198.145.29.99]:58250 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726010AbfJGJiY (ORCPT ); Mon, 7 Oct 2019 05:38:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 51B1C21655; Mon, 7 Oct 2019 09:38:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570441101; bh=3zhwfHIcLxbbQ+KpMXuhI+igbeHR1uDpFIhjOQRNKws=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=xhb9NYnljNV1xaVQoNXkMjTFv8xFVwvlhvXK4T26Gs97v9UHxKRdpu+nh7lconEFf LaCA52oK2CY9iuiQSync4Amm0bhSZeC0dviaQ3ejyxtBkyzHUoF8aKDt+3Ed3clXCW TS3MgAFsmDHpRMFHKaLl8QSae5HIAOztyxbzJvYY= Date: Mon, 7 Oct 2019 11:38:19 +0200 From: Greg Kroah-Hartman To: Martijn Coenen Cc: LKML , stable@vger.kernel.org, syzbot , Mattias Nissler Subject: Re: [PATCH 4.9 30/47] ANDROID: binder: remove waitqueue when thread exits. Message-ID: <20191007093819.GA84909@kroah.com> References: <20191006172016.873463083@linuxfoundation.org> <20191006172018.480360174@linuxfoundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.12.2 (2019-09-21) Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Mon, Oct 07, 2019 at 11:33:53AM +0200, Martijn Coenen wrote: > On Sun, Oct 6, 2019 at 7:23 PM Greg Kroah-Hartman > wrote: > > > > From: Martijn Coenen > > > > commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream. > > > > binder_poll() passes the thread->wait waitqueue that > > can be slept on for work. When a thread that uses > > epoll explicitly exits using BINDER_THREAD_EXIT, > > the waitqueue is freed, but it is never removed > > from the corresponding epoll data structure. When > > the process subsequently exits, the epoll cleanup > > code tries to access the waitlist, which results in > > a use-after-free. > > > > Prevent this by using POLLFREE when the thread exits. > > > > Signed-off-by: Martijn Coenen > > Reported-by: syzbot > > Cc: stable # 4.14 > > [backport BINDER_LOOPER_STATE_POLL logic as well] > > Signed-off-by: Mattias Nissler > > Signed-off-by: Greg Kroah-Hartman > > --- > > drivers/android/binder.c | 17 ++++++++++++++++- > > 1 file changed, 16 insertions(+), 1 deletion(-) > > > > --- a/drivers/android/binder.c > > +++ b/drivers/android/binder.c > > @@ -334,7 +334,8 @@ enum { > > BINDER_LOOPER_STATE_EXITED = 0x04, > > BINDER_LOOPER_STATE_INVALID = 0x08, > > BINDER_LOOPER_STATE_WAITING = 0x10, > > - BINDER_LOOPER_STATE_NEED_RETURN = 0x20 > > + BINDER_LOOPER_STATE_NEED_RETURN = 0x20, > > + BINDER_LOOPER_STATE_POLL = 0x40, > > }; > > > > struct binder_thread { > > @@ -2628,6 +2629,18 @@ static int binder_free_thread(struct bin > > } else > > BUG(); > > } > > + > > + /* > > + * If this thread used poll, make sure we remove the waitqueue > > + * from any epoll data structures holding it with POLLFREE. > > + * waitqueue_active() is safe to use here because we're holding > > + * the inner lock. > > This should be "global lock" in 4.9 and 4.4 :) I'll go update the comment now, thanks! > Otherwise LGTM, thanks! thanks for the review. greg k-h