On Thu, Nov 16, 2017 at 09:56:50AM -0800, Todd Kjos wrote: > proc->files cleanup is initiated by binder_vma_close. Therefore > a reference on the binder_proc is not enough to prevent the > files_struct from being released while the binder_proc still has > a reference. This can lead to an attempt to dereference the > stale pointer obtained from proc->files prior to proc->files > cleanup. This has been seen once in task_get_unused_fd_flags() > when __alloc_fd() is called with a stale "files". > > The fix is to always use get_files_struct() to obtain struct_files > so that the refcount on the files_struct is used to prevent > a premature free. proc->files is removed since we get it every > time. > > Signed-off-by: Todd Kjos <tkjos@xxxxxxxxxx> > --- > drivers/android/binder.c | 63 +++++++++++++++++++++++------------------------- > 1 file changed, 30 insertions(+), 33 deletions(-) For a v2 patch (or v3 or whatever), you need to put below the --- line what changed from the previous version(s). Documentation/SubmittingPatches describes this pretty well :) thanks, greg k-h _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
