| commit | 7b142d8fd0bd4c9bf06ccb72ac4daedb503f0124 | |
| author | Jann Horn <jannh@google.com> | |
| Wed, 15 Jun 2016 22:45:33 +0000 (16 00:45 +0200) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Mon, 15 Aug 2016 14:59:23 +0000 (15 16:59 +0200) | ||
| tree | bf9d3363c73c6de066152384b4608a259bd473e0 | treesnapshot (tar.gz zip) |
| parent | 7ef9153d9af5fe7ce32dcc0f558bfcfc3d2b3016 | commitdiff |
android: binder: fix dangling pointer comparison
If /dev/binder is opened and the opener process then e.g. calls execve,
proc->vma_vm_mm will still point to the location of the now-freed
mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling
proc->vma_vm_mm pointer will be compared to current->mm.
Let the binder take a reference to the mm_struct to avoid this.
v2: use the right refcounter
Fixes: a906d6931f3c ("android: binder: Sanity check at binder ioctl")
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Chen Feng <puck.chen@hisilicon.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
If /dev/binder is opened and the opener process then e.g. calls execve,
proc->vma_vm_mm will still point to the location of the now-freed
mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling
proc->vma_vm_mm pointer will be compared to current->mm.
Let the binder take a reference to the mm_struct to avoid this.
v2: use the right refcounter
Fixes: a906d6931f3c ("android: binder: Sanity check at binder ioctl")
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Chen Feng <puck.chen@hisilicon.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| drivers/android/binder.c | diffblobblamehistory |