From: Schspa Shi <schspa@gmail.com>
To: gregkh@linuxfoundation.org, arve@android.com, tkjos@android.com,
maco@android.com, joel@joelfernandes.org, brauner@kernel.org,
hridya@google.com, surenb@google.com, cmllamas@google.com
Cc: linux-kernel@vger.kernel.org, schspa@gmail.com,
syzbot+46fff6434a7f968ecb39@syzkaller.appspotmail.com
Subject: [PATCH v2] binder: fix atomic sleep when get extended error
Date: Wed, 18 May 2022 09:17:54 +0800 [thread overview]
Message-ID: <20220518011754.49348-1-schspa@gmail.com> (raw)
binder_inner_proc_lock(thread->proc) is a spin lock, copy_to_user can't
be called with in this lock.
Copy it as a local variable to fix it.
Reported-by: syzbot+46fff6434a7f968ecb39@syzkaller.appspotmail.com
Fixes: bd32889e841c ("binder: add BINDER_GET_EXTENDED_ERROR ioctl")
Signed-off-by: Schspa Shi <schspa@gmail.com>
---
Changelog:
v1 -> v2:
- Remove the retry as Carlos Llamas adviced.
- Use binder_set_extended_error to reset the error info.
---
drivers/android/binder.c | 15 ++++++---------
1 file changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d9253b2a7bd9..1a6b7a8c8346 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5162,19 +5162,16 @@ static int binder_ioctl_get_freezer_info(
static int binder_ioctl_get_extended_error(struct binder_thread *thread,
void __user *ubuf)
{
- struct binder_extended_error *ee = &thread->ee;
+ struct binder_extended_error ee;
binder_inner_proc_lock(thread->proc);
- if (copy_to_user(ubuf, ee, sizeof(*ee))) {
- binder_inner_proc_unlock(thread->proc);
- return -EFAULT;
- }
-
- ee->id = 0;
- ee->command = BR_OK;
- ee->param = 0;
+ ee = thread->ee;
+ binder_set_extended_error(&thread->ee, 0, BR_OK, 0);
binder_inner_proc_unlock(thread->proc);
+ if (copy_to_user(ubuf, &ee, sizeof(ee)))
+ return -EFAULT;
+
return 0;
}
--
2.24.3 (Apple Git-128)
next reply other threads:[~2022-05-18 1:18 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-18 1:17 Schspa Shi [this message]
2022-05-18 1:27 ` [PATCH v2] binder: fix atomic sleep when get extended error Carlos Llamas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220518011754.49348-1-schspa@gmail.com \
--to=schspa@gmail.com \
--cc=arve@android.com \
--cc=brauner@kernel.org \
--cc=cmllamas@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=hridya@google.com \
--cc=joel@joelfernandes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=surenb@google.com \
--cc=syzbot+46fff6434a7f968ecb39@syzkaller.appspotmail.com \
--cc=tkjos@android.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.