binder: fix possible UAF when freeing buffer (a370003c) · Commits · 戴 / test

There is a race between the binder driver cleaning up a completed transaction via binder_free_transaction() and a user calling binder_ioctl(BC_FREE_BUFFER) to release a buffer. It doesn't matter which is first but they need to be protected against running concurrently which can result in a UAF. Signed-off-by:

Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/android/binder.c

+14 −2

Original line number	Diff line number	Diff line
		@@ -1941,8 +1941,18 @@ static void binder_free_txn_fixups(struct binder_transaction *t)

		static void binder_free_transaction(struct binder_transaction *t)
		{
		struct binder_proc *target_proc = t->to_proc;

		if (target_proc) {
		binder_inner_proc_lock(target_proc);
		if (t->buffer)
		t->buffer->transaction = NULL;
		binder_inner_proc_unlock(target_proc);
		}
		/*
		* If the transaction has no target_proc, then
		* t->buffer->transaction has already been cleared.
		*/
		binder_free_txn_fixups(t);
		kfree(t);
		binder_stats_deleted(BINDER_STAT_TRANSACTION);
		@@ -3551,10 +3561,12 @@ err_invalid_target_handle:
		static void
		binder_free_buf(struct binder_proc proc, struct binder_buffer buffer)
		{
		binder_inner_proc_lock(proc);
		if (buffer->transaction) {
		buffer->transaction->buffer = NULL;
		buffer->transaction = NULL;
		}
		binder_inner_proc_unlock(proc);
		if (buffer->async_transaction && buffer->target_node) {
		struct binder_node *buf_node;
		struct binder_work *w;

Admin message