Messages in this thread | | | Date | Sat, 7 Oct 2023 19:43:50 +0800 | Subject | Re: [PATCH] binder: add mutex_lock for mmap and NULL when free | From | Kassey Li <> |
| |
On 2023/10/7 19:37, Greg KH wrote: > On Sat, Oct 07, 2023 at 07:34:05PM +0800, Kassey Li wrote: >> >> >> On 2023/10/7 19:18, Greg KH wrote: >>> On Sat, Oct 07, 2023 at 07:07:40PM +0800, Kassey Li wrote: >>>> >>>> >>>> On 2023/10/7 14:44, Greg KH wrote: >>>>> On Sat, Oct 07, 2023 at 11:40:46AM +0800, Kassey Li wrote: >>>>>> Enforce alloc->mutex in binder_alloc_mmap_handler when add >>>>>> the entry to list. >>>>>> >>>>>> Assign the freed pages/page_ptr to NULL to catch possible >>>>>> use after free with NULL pointer access. >>>>>> >>>>>> Signed-off-by: Kassey Li <quic_yingangl@quicinc.com> >>>>>> --- >>>>>> drivers/android/binder_alloc.c | 5 ++++- >>>>>> 1 file changed, 4 insertions(+), 1 deletion(-) >>>>> >>>>> What commit id does this fix? >>>> >>>> there is no specific commit id this change going to fix. >>>> >>>> it is a follow up for commit >>>> 19c987241ca1216a51118b2bd0185b8bc5081783 binder: separate out binder_alloc >>>> functions (mutex lock added for list access in alloc/free) >>>> f2517eb76f1f2f7f89761f9db2b202e89931738c android: binder: Add global lru >>>> shrinker to binder (set page->page_ptr = NULL;) >>>> >>>> the background to raise this change that we are easy hit below crash in >>>> monkey test: >>>> >>>> where a wrong end is passing to >>>> binder_update_page_range, thus calculate a weird index >>>> for >>>> page = &alloc->pages[index] >>> >>> Obviously it is a fix for some commit, please list that here. >> >> ok, please kindly review this patch description according your suggest, i >> can re-send v2 patch again. >> >> commit 16aaeb8556ff4eb75823c56773ee82b06bac44a0 (HEAD -> master) >> Author: Kassey Li <quic_yingangl@quicinc.com> >> Date: Thu Sep 28 10:42:52 2023 +0800 >> >> binder: add mutex_lock for mmap and NULL when free >> >> -Enforce alloc->mutex in binder_alloc_mmap_handler when add >> the entry to list. >> >> -Assign the freed pages/page_ptr to NULL to catch possible >> use after free with NULL pointer access. > > Odd indentation :(
thanks for the quick suggest and review, based on this version, will do below and send patch v2.
./scripts/checkpatch.pl 0001-binder-add-mutex_lock-for-mmap-and-NULL-when-free.patch total: 0 errors, 0 warnings, 26 lines checked
0001-binder-add-mutex_lock-for-mmap-and-NULL-when-free.patch has no obvious style problems and is ready for submission.
> >> Fixes: 19c987241ca1 ("binder: separate out binder_alloc functions") >> Fixes: f2517eb76f1f ("android: binder: Add global lru shrinker to >> binder") >> Signed-off-by: Kassey Li <quic_yingangl@quicinc.com> > > Looks better than before, thanks. > > greg k-h
| |