From: Martijn Coenen <maco@android.com>
To: Minchan Kim <minchan@kernel.org>
Cc: "Dae R. Jeong" <threeearcat@gmail.com>,
"Greg KH" <gregkh@linuxfoundation.org>,
"Arve Hjønnevåg" <arve@android.com>,
"Todd Kjos" <tkjos@android.com>,
"open list:ANDROID DRIVERS" <devel@driverdev.osuosl.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: KASAN: null-ptr-deref Write in binder_update_page_range
Date: Mon, 27 Aug 2018 15:35:24 +0200 [thread overview]
Message-ID: <CAB0TPYGZHD2rH=Ce8GzB451rnukzV8vxNGJ4oJQKa347P8qORA@mail.gmail.com> (raw)
In-Reply-To: <20180823052956.GA28628@rodete-desktop-imager.corp.google.com>
Thanks Minchan!
On Thu, Aug 23, 2018 at 7:29 AM, Minchan Kim <minchan@kernel.org> wrote:
> Signed-off-by: Todd Kjos <tkjos@google.com>
> Signed-off-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Martijn Coenen <maco@android.com>
> ---
> drivers/android/binder_alloc.c | 43 +++++++++++++++++++++++++++-------
> 1 file changed, 35 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
> index 3f3b7b253445..64fd96eada31 100644
> --- a/drivers/android/binder_alloc.c
> +++ b/drivers/android/binder_alloc.c
> @@ -332,6 +332,35 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
> return vma ? -ENOMEM : -ESRCH;
> }
>
> +
> +static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
> + struct vm_area_struct *vma)
> +{
> + if (vma)
> + alloc->vma_vm_mm = vma->vm_mm;
> + /*
> + * If we see alloc->vma is not NULL, buffer data structures set up
> + * completely. Look at smp_rmb side binder_alloc_get_vma.
> + * We also want to guarantee new alloc->vma_vm_mm is always visible
> + * if alloc->vma is set.
> + */
> + smp_wmb();
> + alloc->vma = vma;
> +}
> +
> +static inline struct vm_area_struct *binder_alloc_get_vma(
> + struct binder_alloc *alloc)
> +{
> + struct vm_area_struct *vma = NULL;
> +
> + if (alloc->vma) {
> + /* Look at description in binder_alloc_set_vma */
> + smp_rmb();
> + vma = alloc->vma;
> + }
> + return vma;
> +}
> +
> static struct binder_buffer *binder_alloc_new_buf_locked(
> struct binder_alloc *alloc,
> size_t data_size,
> @@ -348,7 +377,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
> size_t size, data_offsets_size;
> int ret;
>
> - if (alloc->vma == NULL) {
> + if (!binder_alloc_get_vma(alloc)) {
> binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
> "%d: binder_alloc_buf, no vma\n",
> alloc->pid);
> @@ -723,9 +752,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
> buffer->free = 1;
> binder_insert_free_buffer(alloc, buffer);
> alloc->free_async_space = alloc->buffer_size / 2;
> - barrier();
> - alloc->vma = vma;
> - alloc->vma_vm_mm = vma->vm_mm;
> + binder_alloc_set_vma(alloc, vma);
> mmgrab(alloc->vma_vm_mm);
>
> return 0;
> @@ -754,10 +781,10 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc)
> int buffers, page_count;
> struct binder_buffer *buffer;
>
> - BUG_ON(alloc->vma);
> -
> buffers = 0;
> mutex_lock(&alloc->mutex);
> + BUG_ON(alloc->vma);
> +
> while ((n = rb_first(&alloc->allocated_buffers))) {
> buffer = rb_entry(n, struct binder_buffer, rb_node);
>
> @@ -900,7 +927,7 @@ int binder_alloc_get_allocated_count(struct binder_alloc *alloc)
> */
> void binder_alloc_vma_close(struct binder_alloc *alloc)
> {
> - WRITE_ONCE(alloc->vma, NULL);
> + binder_alloc_set_vma(alloc, NULL);
> }
>
> /**
> @@ -935,7 +962,7 @@ enum lru_status binder_alloc_free_page(struct list_head *item,
>
> index = page - alloc->pages;
> page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
> - vma = alloc->vma;
> + vma = binder_alloc_get_vma(alloc);
> if (vma) {
> if (!mmget_not_zero(alloc->vma_vm_mm))
> goto err_mmget;
> --
> 2.18.0.1017.ga543ac7ca45-goog
>
>
>
>
next prev parent reply other threads:[~2018-08-27 13:35 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-22 6:07 KASAN: null-ptr-deref Write in binder_update_page_range Dae R. Jeong
2018-08-23 5:29 ` Minchan Kim
2018-08-23 10:03 ` Dae R. Jeong
2018-08-24 0:36 ` Minchan Kim
2018-08-27 13:35 ` Martijn Coenen [this message]
2018-09-07 3:34 ` Minchan Kim
2018-09-12 7:18 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAB0TPYGZHD2rH=Ce8GzB451rnukzV8vxNGJ4oJQKa347P8qORA@mail.gmail.com' \
--to=maco@android.com \
--cc=arve@android.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=minchan@kernel.org \
--cc=threeearcat@gmail.com \
--cc=tkjos@android.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).