* [PATCH] binder: fix possible UAF when freeing buffer
@ 2019-06-12 20:29 Todd Kjos
2019-06-13 5:41 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Todd Kjos @ 2019-06-12 20:29 UTC (permalink / raw)
To: tkjos, gregkh, arve, devel, linux-kernel, maco; +Cc: joel, kernel-team
There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.
Signed-off-by: Todd Kjos <tkjos@google.com>
---
drivers/android/binder.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 748ac489ef7eb..bc26b5511f0a9 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1941,8 +1941,18 @@ static void binder_free_txn_fixups(struct binder_transaction *t)
static void binder_free_transaction(struct binder_transaction *t)
{
- if (t->buffer)
- t->buffer->transaction = NULL;
+ struct binder_proc *target_proc = t->to_proc;
+
+ if (target_proc) {
+ binder_inner_proc_lock(target_proc);
+ if (t->buffer)
+ t->buffer->transaction = NULL;
+ binder_inner_proc_unlock(target_proc);
+ }
+ /*
+ * If the transaction has no target_proc, then
+ * t->buffer->transaction has already been cleared.
+ */
binder_free_txn_fixups(t);
kfree(t);
binder_stats_deleted(BINDER_STAT_TRANSACTION);
@@ -3551,10 +3561,12 @@ static void binder_transaction(struct binder_proc *proc,
static void
binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer)
{
+ binder_inner_proc_lock(proc);
if (buffer->transaction) {
buffer->transaction->buffer = NULL;
buffer->transaction = NULL;
}
+ binder_inner_proc_unlock(proc);
if (buffer->async_transaction && buffer->target_node) {
struct binder_node *buf_node;
struct binder_work *w;
--
2.22.0.rc2.383.gf4fbbf30c2-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] binder: fix possible UAF when freeing buffer
2019-06-12 20:29 [PATCH] binder: fix possible UAF when freeing buffer Todd Kjos
@ 2019-06-13 5:41 ` Greg KH
2019-06-13 15:43 ` Todd Kjos
0 siblings, 1 reply; 3+ messages in thread
From: Greg KH @ 2019-06-13 5:41 UTC (permalink / raw)
To: Todd Kjos; +Cc: tkjos, arve, devel, linux-kernel, maco, joel, kernel-team
On Wed, Jun 12, 2019 at 01:29:27PM -0700, Todd Kjos wrote:
> There is a race between the binder driver cleaning
> up a completed transaction via binder_free_transaction()
> and a user calling binder_ioctl(BC_FREE_BUFFER) to
> release a buffer. It doesn't matter which is first but
> they need to be protected against running concurrently
> which can result in a UAF.
>
> Signed-off-by: Todd Kjos <tkjos@google.com>
> ---
> drivers/android/binder.c | 16 ++++++++++++++--
> 1 file changed, 14 insertions(+), 2 deletions(-)
Does this also need to go to the stable kernels?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] binder: fix possible UAF when freeing buffer
2019-06-13 5:41 ` Greg KH
@ 2019-06-13 15:43 ` Todd Kjos
0 siblings, 0 replies; 3+ messages in thread
From: Todd Kjos @ 2019-06-13 15:43 UTC (permalink / raw)
To: Greg KH
Cc: Todd Kjos, Arve Hjønnevåg, open list:ANDROID DRIVERS,
LKML, Martijn Coenen, Joel Fernandes (Google),
Android Kernel Team
On Wed, Jun 12, 2019 at 10:41 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Jun 12, 2019 at 01:29:27PM -0700, Todd Kjos wrote:
> > There is a race between the binder driver cleaning
> > up a completed transaction via binder_free_transaction()
> > and a user calling binder_ioctl(BC_FREE_BUFFER) to
> > release a buffer. It doesn't matter which is first but
> > they need to be protected against running concurrently
> > which can result in a UAF.
> >
> > Signed-off-by: Todd Kjos <tkjos@google.com>
> > ---
> > drivers/android/binder.c | 16 ++++++++++++++--
> > 1 file changed, 14 insertions(+), 2 deletions(-)
>
> Does this also need to go to the stable kernels?
This patch won't apply cleanly to stable kernels so I'll submit a new
patch directly to stable@ (4.14, 4.19) once this one lands.
>
> thanks,
>
> greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-13 16:45 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-12 20:29 [PATCH] binder: fix possible UAF when freeing buffer Todd Kjos
2019-06-13 5:41 ` Greg KH
2019-06-13 15:43 ` Todd Kjos
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).