On Thu, Jun 16, 2016 at 12:45:33AM +0200, Jann Horn wrote:
> If /dev/binder is opened and the opener process then e.g. calls execve,
> proc->vma_vm_mm will still point to the location of the now-freed
> mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling
> proc->vma_vm_mm pointer will be compared to current->mm.
>
> Let the binder take a reference to the mm_struct to avoid this.
>
> v2: use the right refcounter
>
> Fixes: a906d6931f3ccaf7de805643190765ddd7378e27
Nit, the proper way to do this is:
Fixes: a906d6931f3c ("android: binder: Sanity check at binder ioctl")
You can get that by doing:
git show -s --abbrev-commit --abbrev=12 --pretty=format:"%h (\"%s\")%n" a906d6931f3ccaf7de805643190765ddd7378e27
Also, I'm guessing this should go to the stable kernels that include the
above patch?
thanks,
greg k-h
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
