Commit f5cb779b authored Jan 05, 2018 by Martijn Coenen Committed by Greg Kroah-Hartman Jan 09, 2018

ANDROID: binder: remove waitqueue when thread exits.



binder_poll() passes the thread->wait waitqueue that
can be slept on for work. When a thread that uses
epoll explicitly exits using BINDER_THREAD_EXIT,
the waitqueue is freed, but it is never removed
from the corresponding epoll data structure. When
the process subsequently exits, the epoll cleanup
code tries to access the waitlist, which results in
a use-after-free.

Prevent this by using POLLFREE when the thread exits.

Signed-off-by: Martijn Coenen <maco@android.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: stable <stable@vger.kernel.org> # 4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 16ae30ea

drivers/android/binder.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -4365,6 +4365,18 @@ static int binder_thread_release(struct binder_proc *proc,
		if (t)
		spin_lock(&t->lock);
		}

		/*
		* If this thread used poll, make sure we remove the waitqueue
		* from any epoll data structures holding it with POLLFREE.
		* waitqueue_active() is safe to use here because we're holding
		* the inner lock.
		*/
		if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
		waitqueue_active(&thread->wait)) {
		wake_up_poll(&thread->wait, POLLHUP \| POLLFREE);
		}

		binder_inner_proc_unlock(thread->proc);

		if (send_reply)

Admin message