Sorry about that, do you want a v3 with correct annotations? On Thu, Nov 16, 2017 at 12:27 PM, Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> wrote: > On Thu, Nov 16, 2017 at 09:56:50AM -0800, Todd Kjos wrote: >> proc->files cleanup is initiated by binder_vma_close. Therefore >> a reference on the binder_proc is not enough to prevent the >> files_struct from being released while the binder_proc still has >> a reference. This can lead to an attempt to dereference the >> stale pointer obtained from proc->files prior to proc->files >> cleanup. This has been seen once in task_get_unused_fd_flags() >> when __alloc_fd() is called with a stale "files". >> >> The fix is to always use get_files_struct() to obtain struct_files >> so that the refcount on the files_struct is used to prevent >> a premature free. proc->files is removed since we get it every >> time. >> >> Signed-off-by: Todd Kjos <tkjos@xxxxxxxxxx> >> --- >> drivers/android/binder.c | 63 +++++++++++++++++++++++------------------------- >> 1 file changed, 30 insertions(+), 33 deletions(-) > > For a v2 patch (or v3 or whatever), you need to put below the --- line > what changed from the previous version(s). > Documentation/SubmittingPatches describes this pretty well :) > > thanks, > > greg k-h _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
