linux/drivers/android
Todd Kjos f3277cbfba binder: fix UAF when releasing todo list
When releasing a thread todo list when tearing down
a binder_proc, the following race was possible which
could result in a use-after-free:

1.  Thread 1: enter binder_release_work from binder_thread_release
2.  Thread 2: binder_update_ref_for_handle() -> binder_dec_node_ilocked()
3.  Thread 2: dec nodeA --> 0 (will free node)
4.  Thread 1: ACQ inner_proc_lock
5.  Thread 2: block on inner_proc_lock
6.  Thread 1: dequeue work (BINDER_WORK_NODE, part of nodeA)
7.  Thread 1: REL inner_proc_lock
8.  Thread 2: ACQ inner_proc_lock
9.  Thread 2: todo list cleanup, but work was already dequeued
10. Thread 2: free node
11. Thread 2: REL inner_proc_lock
12. Thread 1: deref w->type (UAF)

The problem was that for a BINDER_WORK_NODE, the binder_work element
must not be accessed after releasing the inner_proc_lock while
processing the todo list elements since another thread might be
handling a deref on the node containing the binder_work element
leading to the node being freed.

Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201009232455.4054810-1-tkjos@google.com
Cc: <stable@vger.kernel.org> # 4.14, 4.19, 5.4, 5.8
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-10 12:40:52 +02:00
..
binder_alloc_selftest.c binder: print warnings when detecting oneway spamming. 2020-09-03 18:24:41 +02:00
binder_alloc.c binder: remove redundant assignment to pointer n 2020-09-16 17:30:37 +02:00
binder_alloc.h binder: print warnings when detecting oneway spamming. 2020-09-03 18:24:41 +02:00
binder_internal.h binder: prevent UAF for binderfs devices II 2020-03-03 19:58:37 +01:00
binder_trace.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
binder.c binder: fix UAF when releasing todo list 2020-10-10 12:40:52 +02:00
binderfs.c binderfs: make symbol 'binderfs_fs_parameters' static 2020-09-03 18:24:39 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00