linux/drivers
Liam R. Howlett a43cfc87ca android: binder: stop saving a pointer to the VMA
Do not record a pointer to a VMA outside of the mmap_lock for later use. 
This is unsafe and there are a number of failure paths *after* the
recorded VMA pointer may be freed during setup.  There is no callback to
the driver to clear the saved pointer from generic mm code.  Furthermore,
the VMA pointer may become stale if any number of VMA operations end up
freeing the VMA so saving it was fragile to being with.

Instead, change the binder_alloc struct to record the start address of the
VMA and use vma_lookup() to get the vma when needed.  Add lockdep
mmap_lock checks on updates to the vma pointer to ensure the lock is held
and depend on that lock for synchronization of readers and writers - which
was already the case anyways, so the smp_wmb()/smp_rmb() was not
necessary.

[akpm@linux-foundation.org: fix drivers/android/binder_alloc_selftest.c]
Link: https://lkml.kernel.org/r/20220621140212.vpkio64idahetbyf@revolver
Fixes: da1b9564e8 ("android: binder: fix the race mmap and alloc_new_buf_locked")
Reported-by: syzbot+58b51ac2b04e388ab7b0@syzkaller.appspotmail.com
Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Christian Brauner (Microsoft) <brauner@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hridya Valsaraju <hridya@google.com>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Martijn Coenen <maco@android.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Todd Kjos <tkjos@android.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2022-07-29 18:07:13 -07:00
..
accessibility Revert "speakup: Generate speakupmap.h automatically" 2022-05-20 21:07:05 +02:00
acpi More power management updates for 5.19-rc1 2022-05-30 11:37:26 -07:00
amba Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
android android: binder: stop saving a pointer to the VMA 2022-07-29 18:07:13 -07:00
ata ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files 2022-06-09 09:25:25 +09:00
atm
auxdisplay
base Minor things, mainly - mailmap updates, MAINTAINERS updates, etc. 2022-06-26 14:00:55 -07:00
bcma
block zram: fix unused 'zram_wb_devops' warning 2022-07-17 17:14:48 -07:00
bluetooth Bluetooth: btmtksdio: fix the reset takes too long 2022-05-13 13:19:01 +02:00
bus ARM: SoC fixes for 5.19 2022-06-26 14:12:56 -07:00
cdrom cdrom: remove obsolete TODO list 2022-05-15 18:31:28 -06:00
char random: update comment from copy_to_user() -> copy_to_iter() 2022-06-20 11:06:17 +02:00
clk Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
clocksource clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() 2022-06-08 12:27:08 +00:00
comedi comedi: vmk80xx: fix expression for tx buffer size 2022-06-10 15:21:23 +02:00
connector
counter
cpufreq ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
cpuidle Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
crypto virtio-crypto: enable retry for virtio-crypto-dev 2022-05-31 12:45:09 -04:00
cxl cxl/port: Enable HDM Capability after validating DVSEC Ranges 2022-05-20 12:30:53 -07:00
dax dax: introduce holder for dax_device 2022-07-17 17:14:30 -07:00
dca
devfreq PM / devfreq: passive: Return non-error when not-supported event is required 2022-05-19 19:32:19 +02:00
dio drivers: dio: add missing iounmap() in dio_init() 2022-05-19 18:56:51 +02:00
dma dmaengine updates for v5.19-rc1 2022-05-29 11:38:27 -07:00
dma-buf udmabuf: add back sanity check 2022-06-20 08:38:29 -05:00
edac - A gargen variety of fixes which don't fit any other tip bucket: 2022-05-23 19:32:59 -07:00
eisa
extcon extcon: Modify extcon device to be created after driver data is set 2022-05-13 17:03:41 +09:00
firewire firewire: convert sysfs sprintf/snprintf family to sysfs_emit 2022-06-17 10:43:20 +02:00
firmware ARM: SoC fixes for 5.19 2022-06-26 14:12:56 -07:00
fpga
fsi
gnss
gpio gpio fixes for v5.19-rc4 2022-06-24 17:01:31 -07:00
gpu drm/amdkfd: add SPM support for SVM 2022-07-17 17:14:28 -07:00
greybus
hid HID: hyperv: Correctly access fields declared as __le16 2022-06-08 12:28:13 +00:00
hsi
hte hte: Uninitialized variable in hte_ts_get() 2022-05-20 15:54:41 +02:00
hv Drivers: hv: vmbus: Release cpu lock in error case 2022-06-10 08:41:28 +00:00
hwmon hwmon: (asus-ec-sensors) add missing comma in board name list. 2022-06-15 08:14:38 -07:00
hwspinlock
hwtracing
i2c i2c: mediatek: Fix an error handling path in mtk_i2c_probe() 2022-06-14 22:11:54 +02:00
i3c i3c: master: svc: fix returnvar.cocci warning 2022-05-17 22:34:42 +02:00
idle cpuidle,intel_idle: Fix CPUIDLE_FLAG_IRQ_ENABLE 2022-06-08 18:05:45 +02:00
iio 1st set of IIO fixes for the 5.19 cycle. 2022-06-20 09:49:52 +02:00
infiniband v5.19 pull request 2022-05-26 21:08:40 -07:00
input Input updates for v5.19-rc1 2022-06-07 15:00:29 -07:00
interconnect Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
iommu iommu/ipmmu-vmsa: Fix compatible for rcar-gen4 2022-06-22 15:45:56 +02:00
ipack
irqchip irqchip/loongson-liointc: Use architecture register to get coreid 2022-06-10 08:57:19 +01:00
isdn
leds ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
macintosh macintosh: via-pmu and via-cuda need RTC_LIB 2022-05-22 15:58:30 +10:00
mailbox mailbox: qcom-ipcc: Fix -Wunused-function with CONFIG_PM_SLEEP=n 2022-05-24 08:08:24 -05:00
mcb
md dax: introduce holder for dax_device 2022-07-17 17:14:30 -07:00
media USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
memory memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings 2022-06-06 11:18:20 +02:00
memstick
message
mfd ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
misc mm: shrinkers: provide shrinkers with names 2022-07-03 18:08:40 -07:00
mmc mmc: mediatek: wait dma stop bit reset to 0 2022-06-15 10:05:56 -07:00
most
mtd mtd: rawnand: gpmi: Fix setting busy timeout setting 2022-06-16 16:46:08 +02:00
mux
net virtio_net: fix xdp_rxq_info bug after suspend/resume 2022-06-22 19:09:13 -07:00
nfc nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred 2022-06-08 10:18:10 -07:00
ntb
nubus
nvdimm pagemap,pmem: introduce ->memory_failure() 2022-07-17 17:14:30 -07:00
nvme nvme: move the Samsung X5 quirk entry to the core quirks 2022-06-23 15:22:22 +02:00
nvmem
of mm: kmemleak: remove kmemleak_not_leak_phys() and the min_count argument to kmemleak_alloc_phys() 2022-06-16 19:48:30 -07:00
opp OPP updates for 5.19-rc1 2022-05-25 15:02:26 +02:00
parisc
parport
pci Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
pcmcia ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
peci
perf arm64 updates for 5.19: 2022-05-23 21:06:11 -07:00
phy phy-for-5.19 2022-05-19 16:56:17 +02:00
pinctrl Pin control bulk changes for the v5.19 series: 2022-05-28 11:15:54 -07:00
platform platform-drivers-x86 for v5.19-2 2022-06-12 11:33:42 -07:00
pnp
power Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
powercap Merge branches 'pm-em' and 'pm-cpuidle' 2022-05-23 19:18:51 +02:00
pps
ps3
ptp ptp: ptp_clockmatrix: fix is_single_shot 2022-05-25 21:51:32 -07:00
pwm pwm: pwm-cros-ec: Add channel type support 2022-05-20 16:40:01 +02:00
rapidio
ras
regulator regulator: qcom_smd: correct MP5496 ranges 2022-06-07 20:38:09 +01:00
remoteproc
reset
rpmsg Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
rtc ARM: multiplatform changes, part 2 2022-06-02 15:23:54 -07:00
s390 Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
sbus
scsi scsi: ibmvfc: Store vhost pointer during subcrq allocation 2022-06-16 21:42:04 -04:00
sh
siox
slimbus Driver core changes for 5.19-rc1 2022-06-03 11:48:47 -07:00
soc This pull request contains Broadcom ARM-based SoCs driver fixes for 2022-06-14 12:20:31 +02:00
soundwire
spi spi: rockchip: Unmask IRQ at the final to avoid preemption 2022-06-20 11:35:43 +01:00
spmi
ssb ssb: remove unreachable code 2022-05-11 08:29:11 +03:00
staging staging: rtl8723bs: Allocate full pwep structure 2022-06-10 09:10:16 +02:00
target blk-mq: remove the done argument to blk_execute_rq_nowait 2022-05-28 06:15:27 -06:00
tc
tee Fix a compiler warning in OP-TEE driver 2022-05-30 14:44:27 +02:00
thermal Additional thermal control update for 5.19-rc1 2022-05-30 11:34:13 -07:00
thunderbolt USB / Thunderbolt changes for 5.19-rc1 2022-06-03 11:17:49 -07:00
tty Merge branch 'rework/kthreads' into for-linus 2022-06-23 19:11:28 +02:00
ufs scsi: ufs: Fix a race between the interrupt handler and the reset handler 2022-06-16 21:32:09 -04:00
uio
usb usb: chipidea: udc: check request status before setting device address 2022-06-24 13:45:23 +02:00
vdpa vduse: Fix NULL pointer dereference on sysfs access 2022-06-08 08:56:03 -04:00
vfio VFIO updates for v5.19-rc1 2022-06-01 13:49:15 -07:00
vhost vdpa: make get_vq_group and set_group_asid optional 2022-06-09 00:26:35 -04:00
video fbdev fixes and updates for kernel v5.19-rc4: 2022-06-26 09:13:51 -07:00
virt Char / Misc / Other smaller driver subsystem updates for 5.19-rc1 2022-06-03 11:36:34 -07:00
virtio mm: shrinkers: provide shrinkers with names 2022-07-03 18:08:40 -07:00
vlynq
vme
w1
watchdog watchdog: gxp: Add missing MODULE_LICENSE 2022-06-09 12:20:34 +02:00
xen mm: shrinkers: provide shrinkers with names 2022-07-03 18:08:40 -07:00
zorro
Kconfig SCSI misc on 20220604 2022-06-05 09:25:12 -07:00
Makefile SCSI misc on 20220604 2022-06-05 09:25:12 -07:00