looks good to me. On 2016/6/16 6:45, Jann Horn wrote: > If /dev/binder is opened and the opener process then e.g. calls execve, > proc->vma_vm_mm will still point to the location of the now-freed > mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling > proc->vma_vm_mm pointer will be compared to current->mm. > > Let the binder take a reference to the mm_struct to avoid this. > > v2: use the right refcounter > > Fixes: a906d6931f3ccaf7de805643190765ddd7378e27 > Signed-off-by: Jann Horn <jannh@xxxxxxxxxx> Reviewed-by: Chen Feng <puck.chen@xxxxxxxxxxxxx> > --- > drivers/android/binder.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index 16288e7..09fdb42 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -2962,6 +2962,7 @@ static int binder_open(struct inode *nodp, struct file *filp) > return -ENOMEM; > get_task_struct(current); > proc->tsk = current; > + atomic_inc(¤t->mm->mm_count); > proc->vma_vm_mm = current->mm; > INIT_LIST_HEAD(&proc->todo); > init_waitqueue_head(&proc->wait); > @@ -3167,6 +3168,7 @@ static void binder_deferred_release(struct binder_proc *proc) > vfree(proc->buffer); > } > > + mmdrop(proc->vma_vm_mm); > put_task_struct(proc->tsk); > > binder_debug(BINDER_DEBUG_OPEN_CLOSE, > _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
