Jann Horn 8eb52a1ee3 binder: Fix race between mmap() and binder_alloc_print_pages() ... binder_alloc_print_pages() iterates over alloc->pages[0..alloc->buffer_size-1] under alloc->mutex. binder_alloc_mmap_handler() writes alloc->pages and alloc->buffer_size without holding that lock, and even writes them before the last bailout point. Unfortunately we can't take the alloc->mutex in the ->mmap() handler because mmap_sem can be taken while alloc->mutex is held. So instead, we have to locklessly check whether the binder_alloc has been fully initialized with binder_alloc_get_vma(), like in binder_alloc_new_buf_locked(). Fixes: 8ef4665aa1 ("android: binder: Add page usage in binder stats") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191018205631.248274-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-11-14 11:44:46 +08:00
..
binder_alloc_selftest.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282	2019-06-05 17:36:37 +02:00
binder_alloc.c	binder: Fix race between mmap() and binder_alloc_print_pages()	2019-11-14 11:44:46 +08:00
binder_alloc.h	binder: return errors from buffer copy functions	2019-07-01 08:42:47 +02:00
binder_internal.h	binder: prevent UAF read in print_binder_transaction_log_entry()	2019-10-10 14:39:22 +02:00
binder_trace.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282	2019-06-05 17:36:37 +02:00
binder.c	Merge 5.4-rc5 into char-misc-next	2019-10-27 18:48:33 +01:00
binderfs.c	binder: Add binder_proc logging to binderfs	2019-09-04 13:31:26 +02:00
Kconfig	binder: add functions to copy to/from binder buffers	2019-02-12 10:43:57 +01:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00