Todd Kjos
1903801ee4
binder: fix UAF when releasing todo list ...
When releasing a thread todo list when tearing down
a binder_proc, the following race was possible which
could result in a use-after-free:
1. Thread 1: enter binder_release_work from binder_thread_release
2. Thread 2: binder_update_ref_for_handle() calls binder_dec_node_ilocked()
3. Thread 2: dec nodeA --> 0 (will free node)
4. Thread 1: ACQ inner_proc_lock
5. Thread 2: block on inner_proc_lock
6. Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA)
7. Thread 1: REL inner_proc_lock
8. Thread 2: ACQ inner_proc_lock
9. Thread 2: todo list cleanup, but work was already dequeued
10. Thread 2: free node
11. Thread 2: REL inner_proc_lock
12. Thread 1: deref w->type (UAF)
The problem was that for a BINDER_WORK_NODE, the binder_work element
must not be accessed after releasing the inner_proc_lock while
processing the todo list elements since another thread might be
handling a deref on the node containing the binder_work element
leading to the node being freed.
Bug: 161151868
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I4ae752abfe1aa38872be6f266ddd271802952625
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Git-commit: cebe72f19bebdee8fc9f1b31dd21a88a259ff419
Signed-off-by: Alam Md Danish <amddan@codeaurora.org>
Signed-off-by: Rahul Shahare <rshaha@codeaurora.org>
2020-11-06 07:19:36 -08:00
This is the 4.9.224 stable release
2020-05-20 11:46:34 +02:00
binder: fix UAF when releasing todo list
2020-11-06 07:19:36 -08:00
libata: Return correct status in sata_pmp_eh_recover_pm() when ATA_DFLAG_DETACH is set
2020-04-24 07:58:59 +02:00
atm: eni: fix uninitialized variable warning
2020-02-05 13:05:41 +00:00
Merge android-4.9.227(892702560) into msm-4.9
2020-06-22 13:43:46 +08:00
bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA
2020-01-29 10:24:31 +01:00
Merge android-4.9.221(cf77b7c) into msm-4.9
2020-05-11 17:25:31 +08:00
Merge android-4.9.209(c830063) into msm-4.9
2020-03-13 15:47:19 +08:00
Merge "Merge android-4.9.221(cf77b7c) into msm-4.9"
2020-05-21 11:29:11 -07:00
cdrom: respect device capabilities during opening action
2020-01-04 13:41:02 +01:00
msm: ADSPRPC: Enable Sensors PDR support
2020-08-29 13:17:34 +05:30
clk: fix compiler issue due to improper braces or indentation
2020-06-02 02:10:35 -07:00
Merge android-4.9.212(7e0f964) into msm-4.9
2020-03-13 15:59:38 +08:00
Merge android-4.9.220(90aa475) into msm-4.9
2020-05-11 14:05:41 +08:00
Merge android-4.9.207(6f0b5b5) into msm-4.9
2020-03-12 15:39:56 +08:00
crypto: Fix possible stack out of bound error
2020-09-16 21:37:22 -07:00
Merge android-4.9.215(60fbe70) into msm-4.9
2020-03-26 09:48:47 +08:00
Merge android-4.9.225(ca8aaf9) into msm-4.9
2020-05-29 17:17:10 +08:00
Merge android-4.9.207(6f0b5b5) into msm-4.9
2020-03-12 15:39:56 +08:00
Merge android-4.9.208(9759f95) into msm-4.9
2020-03-12 15:59:20 +08:00
Merge android-4.9.208(9759f95) into msm-4.9
2020-03-12 15:59:20 +08:00
net: add annotations on hh->hh_len lockless accesses
2020-01-12 11:24:19 +01:00
Merge android-4.9.217(d2adeff) into msm-4.9
2020-03-26 10:40:04 +08:00
Merge android-4.9.226(92339d6) into msm-4.9
2020-06-04 11:32:11 +08:00
Merge "msm: kgsl: Remove dev_err() from fenced write loop"
2020-10-23 02:55:00 -07:00
Merge android-4.9.227(892702560) into msm-4.9
2020-06-22 13:43:46 +08:00
hwmon: qpnp-adc: add battery thermistor mapping table for 8909 skue
2020-07-17 00:22:05 -07:00
tmc-etr: Add ETR status check in usb_notifier
2020-07-21 00:38:32 -07:00
Merge android-4.9.225(ca8aaf9) into msm-4.9
2020-05-29 17:17:10 +08:00
This is the 4.9.215 stable release
2020-02-28 16:59:01 +01:00
Merge "Merge android-4.9.227(892702560) into msm-4.9"
2020-07-08 02:20:36 -07:00
Merge android-4.9.226(92339d6) into msm-4.9
2020-06-04 11:32:11 +08:00
Merge "Merge android-4.9.226(92339d6) into msm-4.9"
2020-06-11 12:23:03 -07:00
Merge android-4.9.226(92339d6) into msm-4.9
2020-06-04 11:32:11 +08:00
Merge android-4.9.220(90aa475) into msm-4.9
2020-05-11 14:05:41 +08:00
This is the 4.9.207 stable release
2019-12-21 11:28:16 +01:00
leds: leds-msm-gpio-flash: add led gpio flash driver
2020-03-26 23:23:58 +05:30
macintosh/windfarm_smu_sat: Fix debug output
2019-11-28 18:28:30 +01:00
Merge android-4.9.187 ( fabc071) into msm-4.9
2019-10-11 14:38:02 +08:00
Merge android-4.9.222(5da84b2) into msm-4.9
2020-05-11 18:01:57 +08:00
msm: vidc: increase max instance support to 24
2020-10-24 11:34:11 +05:30
memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
2019-10-29 09:15:25 +01:00
This is the 4.9.211 stable release
2020-01-23 09:20:25 +01:00
Merge android-4.9.220(90aa475) into msm-4.9
2020-05-11 14:05:41 +08:00
qseecom: Remove virtual address print
2020-07-08 13:33:38 +05:30
Merge android-4.9.218(1caf614) into msm-4.9
2020-04-10 11:25:59 +08:00
Merge android-4.9.221(cf77b7c) into msm-4.9
2020-05-11 17:25:31 +08:00
Merge "Merge android-4.9.227(892702560) into msm-4.9"
2020-07-08 02:20:36 -07:00
Merge android-4.9.227(892702560) into msm-4.9
2020-06-22 13:43:46 +08:00
ntb: intel: fix return value for ndev_vec_mask()
2019-11-28 18:28:52 +01:00
libnvdimm/btt: Remove unnecessary code in btt_freelist_init
2020-05-27 16:42:00 +02:00
nvme: retain split access workaround for capability reads
2020-01-29 10:24:33 +01:00
Merge android-4.9.227(892702560) into msm-4.9
2020-06-22 13:43:46 +08:00
Merge android-4.9.220(90aa475) into msm-4.9
2020-05-11 14:05:41 +08:00
parisc: Disable HP HSC-PCI Cards to prevent kernel crash
2019-10-05 12:30:31 +02:00
parport: load lowlevel driver if ports not found
2020-01-04 13:39:55 +01:00
msm: msi: Add MSI disable/enable when process MSI intierrupt
2020-07-10 15:49:59 +08:00
Merge android-4.9.203(13ff513) into msm-4.9
2020-01-06 18:07:05 +08:00
Merge "pinctrl: qcom: Enable GPIO 56 for wakeup for sdxpoorwills"
2020-06-12 08:53:59 -07:00
msm: ipa: Fix deleting the routing entries
2020-11-04 10:12:25 -08:00
power: qpnp-smb2/5: Report TIME_TO_FULL_NOW and CHARGE_FULL_DESIGN
2020-08-22 19:23:18 -07:00
ptp: free ptp device pin descriptors properly
2020-05-20 08:15:33 +02:00
Merge android-4.9.221(cf77b7c) into msm-4.9
2020-05-11 17:25:31 +08:00
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 16:42:02 +02:00
Merge android-4.9.215(60fbe70) into msm-4.9
2020-03-26 09:48:47 +08:00
remoteproc: Fix wrong rvring index computation
2020-05-02 17:23:14 +02:00
reset: Fix potential use-after-free in __of_reset_control_get()
2019-11-25 09:53:42 +01:00
Merge android-4.9.220(90aa475) into msm-4.9
2020-05-11 14:05:41 +08:00
scsi: zfcp: fix request object use-after-free in send path causing wrong traces
2020-06-03 08:16:48 +02:00
Merge android-4.9.227(892702560) into msm-4.9
2020-06-22 13:43:46 +08:00
soc: qcom: sideband: add helper APIs for sideband notifications
2020-07-09 10:59:21 -07:00
Merge android-4.9.227(892702560) into msm-4.9
2020-06-22 13:43:46 +08:00
Subject: staging: android: ion: fix ION_IOC_{MAP,SHARE} use-after-free
2020-09-02 03:19:50 -07:00
scsi: target: fix PR IN / READ FULL STATUS for FC
2020-05-02 17:23:17 +02:00
Merge android-4.9.212(7e0f964) into msm-4.9
2020-03-13 15:59:38 +08:00
thunderbolt: Use 32-bit writes when writing ring producer/consumer
2019-11-06 12:18:14 +01:00
Merge "tty: msm_smd_tty: Decrease wakeup timeout to 100ms"
2020-07-13 04:43:01 -07:00
Merge android-4.9.215(60fbe70) into msm-4.9
2020-03-26 09:48:47 +08:00
usb: dwc3-msm: Add markers for peripheral bus resume
2020-07-24 15:52:42 +05:30
This is the 4.9.222 stable release
2020-05-05 19:35:40 +02:00
vhost: vsock: kick send_pkt worker once device is started
2020-05-10 10:28:00 +02:00
msm: mdss: Fix incorrect handle of vsync for SPI display
2020-09-05 10:48:07 +05:30
virtio-balloon: fix managed page counts when migrating pages between zones
2019-12-21 10:41:57 +01:00
vme: bridges: reduce stack usage
2020-02-28 15:42:33 +01:00
Merge android-4.9.225(ca8aaf9) into msm-4.9
2020-05-29 17:17:10 +08:00
xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status
2020-05-02 17:23:17 +02:00
1903801ee4