Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751927AbdHaR0R (ORCPT ); Thu, 31 Aug 2017 13:26:17 -0400 Received: from mail-pg0-f42.google.com ([74.125.83.42]:37412 "EHLO mail-pg0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751571AbdHaR0Q (ORCPT ); Thu, 31 Aug 2017 13:26:16 -0400 X-Google-Smtp-Source: ADKCNb4f5eGtmEOoF5zivAb/xBaYwB7Y0+9Ghog9Gt6amj/75PBle/TEkrA0R4BcJpetoV/sZGY0LA== From: Sherry Yang To: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org Cc: tkjos@google.com, maco@google.com, Sherry Yang , =?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?= , Riley Andrews , devel@driverdev.osuosl.org (open list:ANDROID DRIVERS) Subject: [PATCH] android: binder: fixup crash introduced by moving buffer hdr Date: Thu, 31 Aug 2017 10:26:06 -0700 Message-Id: <20170831172606.51294-1-sherryy@android.com> X-Mailer: git-send-email 2.14.1.581.gf28d330327-goog In-Reply-To: <20170831042812.GA3359@kroah.com> References: <20170831042812.GA3359@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1072 Lines: 31 Fix crash introduced by 74310e06be4d74dcf67cd108366710dee5c576d5 (android: binder: Move buffer out of area shared with user space) when close is called after open without mmap in between. Signed-off-by: Sherry Yang --- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 78c42c0d62b9..2624a502fcde 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -713,7 +713,6 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, } buffer->data = alloc->buffer; - INIT_LIST_HEAD(&alloc->buffers); list_add(&buffer->entry, &alloc->buffers); buffer->free = 1; binder_insert_free_buffer(alloc, buffer); @@ -972,6 +971,7 @@ void binder_alloc_init(struct binder_alloc *alloc) alloc->tsk = current->group_leader; alloc->pid = current->group_leader->pid; mutex_init(&alloc->mutex); + INIT_LIST_HEAD(&alloc->buffers); } void binder_alloc_shrinker_init(void) -- 2.14.1.581.gf28d330327-goog