c88a3ec1ee
proc->files cleanup is initiated by binder_vma_close. Therefore a reference on the binder_proc is not enough to prevent the files_struct from being released while the binder_proc still has a reference. This can lead to an attempt to dereference the stale pointer obtained from proc->files prior to proc->files cleanup. This has been seen once in task_get_unused_fd_flags() when __alloc_fd() is called with a stale "files". The fix is to protect proc->files with a mutex to prevent cleanup while in use. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 7f3dc0088b98533f17128058fac73cd8b2752ef1) Change-Id: I40982bb0b4615bda5459538c20eb2a913964042c |
||
|---|---|---|
| .. | ||
| binder.c | ||
| binder_alloc.c | ||
| binder_alloc.h | ||
| binder_alloc_selftest.c | ||
| binder_trace.h | ||
| Kconfig | ||
| Makefile | ||