Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp3369409ybp; Sun, 6 Oct 2019 10:25:34 -0700 (PDT) X-Google-Smtp-Source: APXvYqwLCWbQPGJ5lXty6n4LUcFTVtnFEdy5omfwVgpojwbhCLlCL4O4V5/OfZ5CxC5tfJgYbhjk X-Received: by 2002:aa7:c71a:: with SMTP id i26mr25628461edq.68.1570382734838; Sun, 06 Oct 2019 10:25:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570382734; cv=none; d=google.com; s=arc-20160816; b=uJgJvz/YhRutvmVVkl2ECeTenM+5nNau1ixf492+qXcmIRvQOVKBkUeRnAXY3bhDNP GpshgLR/gNJOsFdqkR5t8/8fZb9KgmLlECYaSQUmD3V79Wv0KDj2qEDy2Gda1cVWYDev EGplP8eK5e7CKbpUW091REpHfK5UoeTUs4bwRNsQxAPqpbxlG87+fHeNGCr8vlVuDqfD hOvK7OSdliIU1ZmXEis+NwL+8xDFZo9+kCcomWZ98hBfjuR3Ga6HJZ4VyC3aBYLTXrAR b9YRHcDQ/JyZsCeKzbyrAWIsCcIN2Z2NbFLs0m/Hx8zu5WWFLcT2nuN5wR3U60LHeWl9 4kKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=CoN+LOt7vsma+O51KyWA/eE1zvHld14+USKl1tDgVfk=; b=eSqL0kCWX+ZiotLdlYA6MY+BpigR1cAopFwZvdOJzV13WGuOd0DBs1z/csE8e6j4UQ TlofirOC+bQVQoUvVxd0peARz16TzzBoHxEeH4fa2y9wvONPi4fMmlEjDXlGrsBcl/Zs 5Px4jvrV6bf9cm2CpfxTsKnxznumI2TiTdEMEPfBYvnuyc6wQEbnG3ZYS1L4QyAiyRW4 QwnLVf4kgRWxmzGsxHi3DWcadUMfwSK2mY7iiwy2XOBBDFD6lEfe0edi83nJSW+qaMOL Wlom5Y3ATRGRRj358bgT6KXE61/oPia8viKiWG7MEa6m9Fif4IZz8A2D5c99zUi0yvou LiRA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=q2biKQmH; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n2si7116629edt.408.2019.10.06.10.25.10; Sun, 06 Oct 2019 10:25:34 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=q2biKQmH; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727735AbfJFRX6 (ORCPT + 99 others); Sun, 6 Oct 2019 13:23:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:48700 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727717AbfJFRX4 (ORCPT ); Sun, 6 Oct 2019 13:23:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BAF222080F; Sun, 6 Oct 2019 17:23:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1570382635; bh=/7Y+A3zi2z3Cmfpukxe6iEBE6UJaBfI64iHRMUpeFEg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q2biKQmHBY0g1FaVZMrcm0hrPdPaNJ5vD7B1SAtsepgaoR/YX8EHw+ki+RlLzKUnJ //jddaReLuV7PYiy9FlFnJLpzCCiL5JMShTd+5Tz4x5T6O9wuc1+3VQbWP//H1OMYk TaZmYcpj5fOqmxjzU52fLBMagGIH2QzviIR4rhq4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Martijn Coenen , syzbot , Mattias Nissler Subject: [PATCH 4.9 30/47] ANDROID: binder: remove waitqueue when thread exits. Date: Sun, 6 Oct 2019 19:21:17 +0200 Message-Id: <20191006172018.480360174@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191006172016.873463083@linuxfoundation.org> References: <20191006172016.873463083@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Martijn Coenen commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream. binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits. Signed-off-by: Martijn Coenen Reported-by: syzbot Cc: stable # 4.14 [backport BINDER_LOOPER_STATE_POLL logic as well] Signed-off-by: Mattias Nissler Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -334,7 +334,8 @@ enum { BINDER_LOOPER_STATE_EXITED = 0x04, BINDER_LOOPER_STATE_INVALID = 0x08, BINDER_LOOPER_STATE_WAITING = 0x10, - BINDER_LOOPER_STATE_NEED_RETURN = 0x20 + BINDER_LOOPER_STATE_NEED_RETURN = 0x20, + BINDER_LOOPER_STATE_POLL = 0x40, }; struct binder_thread { @@ -2628,6 +2629,18 @@ static int binder_free_thread(struct bin } else BUG(); } + + /* + * If this thread used poll, make sure we remove the waitqueue + * from any epoll data structures holding it with POLLFREE. + * waitqueue_active() is safe to use here because we're holding + * the inner lock. + */ + if ((thread->looper & BINDER_LOOPER_STATE_POLL) && + waitqueue_active(&thread->wait)) { + wake_up_poll(&thread->wait, POLLHUP | POLLFREE); + } + if (send_reply) binder_send_failed_reply(send_reply, BR_DEAD_REPLY); binder_release_work(&thread->todo); @@ -2651,6 +2664,8 @@ static unsigned int binder_poll(struct f return POLLERR; } + thread->looper |= BINDER_LOOPER_STATE_POLL; + wait_for_proc_work = thread->transaction_stack == NULL && list_empty(&thread->todo) && thread->return_error == BR_OK;