This reverts commit ff0771e5f8.
ANDROID_VENDOR_HOOKS was temporarily disabled since it needed
refactoring to work with commit d25e37d89d ("tracepoint: Optimize
using static_call()"). It can be enabled again now.
Change-Id: Id4920fe20cf07736679f22228d192a251467bbb2
Signed-off-by: Todd Kjos <tkjos@google.com>
Commit d25e37d89d ("tracepoint: Optimize using static_call()") changed
the format of DEFINE_TRACE() and other tracepoint logic, which broke the
ANDROID_VENDOR_HOOKS logic.
As I can't figure out how to unwind the build traces for the errors,
disable this for now so the merge can continue.
Bug: 156285741
Cc: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6794bdec76ba25370891747b296ea30a51812982
- Add the hook to provide additional information
of sysrq crash.
Bug: 170234110
Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: Ib8f14eaa639b2ef959e911d611515868ff9f193d
(cherry picked from commit 32b242337266a3b8e170b0ddc4bec478d5cf1f94)
When a kernel panic occurred, it is sometimes caused by a other cpu
than the panic cpu. When a panic cpu sends smp stop IPI, it can help to
solve the problem even more if aonther cpu stores registers and
run cache flush.
Bug: 165956922
Change-Id: I747f776456330d904015cfe4ae423e4b63f18f85
Signed-off-by: Changki Kim <changki.kim@samsung.com>
Signed-off-by: Will McVicker <willmcvicker@google.com>
Signed-off-by: Jonglin Lee <jonglin@google.com>
- Add the hook to provide additional information like
a task scheduling log.
Bug: 169374262
Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I203dbc6faa77687ea48769f76658d28b29ef46fd
(cherry picked from commit 2ea974a00c7bdbbee140d68d8867ddcbfb529ecc)
For modifying load balance policy, we add the hook on
find_busiest_group().
It allows us to modify load balance paths.
Bug: 168248326
Signed-off-by: YT Chang <yt.chang@mediatek.com>
Change-Id: I77ec043576139806551b978eb1bdf9f637442dfb
This reverts commit c5665cafbedd2e2a523fe933e452391a02d3adb3.
This patch was causing display hangs for Qualcomm after the 5.4.58
merge.
Bug: 166779391
Change-Id: Iaf22ede68247422709b00f059e5c4d517f219adf
Signed-off-by: Todd Kjos <tkjos@google.com>
- To use MPAM in kernel task, vendor_hook call is needed to
set MPAM at scheduling time.
- Vendor_hooks is call ed when task is switching for MPAM state
Bug: 165333282
Signed-off-by: C-J.Chen <C-J.Chen@mediatek.com>
Change-Id: I30270c667c26e1a7039580b33011665bb3a8cce7
Current CPU capacity is scaled by frequency
but it will sometime overestimate.
Add vendor hook to adjust cpu capacity.
android_vh_arch_set_freq_scale
Adjust cpu freq scale for each opp.
Bug: 163935827
Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: I054740a7f60301d5a3b085bfa540d52853f5eec5
The hooks function of scheduler tick will need to
insert multiple instances, so that use vendor hook
instead of restricted vendor hook.
Bug: 165787557
Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com>
Change-Id: I750da26452c657d83d5f8c520bf7008693c43a6b
An event that gather the idle state that the cpu attempted to enter and
actually entered is added. Through this, the idle statistics of the cpu
can be obtained and used for vendor specific algorithms or for system
analysis.
Bug: 162980647
Change-Id: I9c2491d524722042e881864488f7b3cf7e903d1e
Signed-off-by: Park Bumgyu <bumgyu.park@samsung.com>
- Add the hook to get mutex/rwsem information that the tasks
are waiting for.
- Add the hook to print messages for sched_show_task.
- ANDROID_VENDOR_DATA_ARRAY added to task_struct
Bug: 162776704
Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: Ib436fbd8d0ad509c3b5a73ea8f5170e0761a13fd
(cherry picked from commit b519ac423787d38f467ca479d2126b7204d6f498)
With commit f70f74d15c ("kconfig: remove '---help---' support") the
"---help---" marking is no longer allowed in Kconfig files.
Unfortunately some old ANDROID patches used this deprecated markings,
which breaks the build.
Fix this up by converting them to the correct style "help"
Bug: 156285741
Bug: 146517987
Bug: 31622239
Bug: 120445368
Bug: 119769411
Bug: 129280212
Fixes: 7f62740112 ("ANDROID: add support for vendor hooks")
Fixes: 2dec8234fe ("ANDROID: gnss: Add command line test driver")
Fixes: 6115619831 ("ANDROID: AVB error handler to invalidate vbmeta partition.")
Fixes: 0ce3eb37e9 ("ANDROID: dm-bow: Add dm-bow feature")
Cc: Todd Kjos <tkjos@google.com>
Cc: Alistair Delva <adelva@google.com>
Cc: David Zeuthen <zeuthen@google.com>
Cc: Paul Lawrence <paullawrence@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I8a503c34b5b4dac6dc3e24afbefa10223a6fd946
Add the hook for the waiter list of futex to allow
vendor perform wait queue enhancement
Bug: 163431711
Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com>
Change-Id: I68218b89c35b23aa5529099bb0bbbd031bdeafef
Add hooks to collect scheduling information and apply vendor's
tuning when task's scheduling priority is changed
Bug: 163431711
Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com>
Change-Id: Ic85835852690d0060666107d9108560f5023496b
Steps on the way to 5.9-rc1
Resolves conflicts in:
drivers/irqchip/qcom-pdc.c
include/linux/device.h
net/xfrm/xfrm_state.c
security/lsm_audit.c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4aeb3d04f4717714a421721eb3ce690c099bb30a
C source files should have `//` as SPDX comment and not `/**/`. Fix this
by running checkpatch on the file.
Signed-off-by: Mrinal Pandey <mrinalmni@gmail.com>
Link: https://lore.kernel.org/r/20200724131449.zvjutbemg3vqhrzh@mrinalpandey
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Binder is designed such that a binder_proc never has references to
itself. If this rule is violated, memory corruption can occur when a
process sends a transaction to itself; see e.g.
<https://syzkaller.appspot.com/bug?extid=09e05aba06723a94d43d>.
There is a remaining edgecase through which such a transaction-to-self
can still occur from the context of a task with BINDER_SET_CONTEXT_MGR
access:
- task A opens /dev/binder twice, creating binder_proc instances P1
and P2
- P1 becomes context manager
- P2 calls ACQUIRE on the magic handle 0, allocating index 0 in its
handle table
- P1 dies (by closing the /dev/binder fd and waiting a bit)
- P2 becomes context manager
- P2 calls ACQUIRE on the magic handle 0, allocating index 1 in its
handle table
[this triggers a warning: "binder: 1974:1974 tried to acquire
reference to desc 0, got 1 instead"]
- task B opens /dev/binder once, creating binder_proc instance P3
- P3 calls P2 (via magic handle 0) with (void*)1 as argument (two-way
transaction)
- P2 receives the handle and uses it to call P3 (two-way transaction)
- P3 calls P2 (via magic handle 0) (two-way transaction)
- P2 calls P2 (via handle 1) (two-way transaction)
And then, if P2 does *NOT* accept the incoming transaction work, but
instead closes the binder fd, we get a crash.
Solve it by preventing the context manager from using ACQUIRE on ref 0.
There shouldn't be any legitimate reason for the context manager to do
that.
Additionally, print a warning if someone manages to find another way to
trigger a transaction-to-self bug in the future.
Cc: stable@vger.kernel.org
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Martijn Coenen <maco@android.com>
Link: https://lore.kernel.org/r/20200727120424.1627555-1-jannh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- Add the hook to apply vendor's performance tune for owner
of rwsem.
- Add the hook for the waiter list of rwsem to allow
vendor perform waiting queue enhancement
- ANDROID_VENDOR_DATA added to rw_semaphore
Bug: 161400830
Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com>
Change-Id: I007a5e26f3db2adaeaf4e5ccea414ce7abfa83b8
- To apply vendor's performance tune for blocked binder transaction,
add the hook on the begin/end of transaction.
- ANDROID_VENDOR_DATA added to binder_transaction.
Bug: 161400830
Signed-off-by: JianMin Liu <jian-min.liu@mediatek.com>
Change-Id: If60870623ce2669200238172737dd8455ac34b02
syzbot is reporting that mmput() from shrinker function has a risk of
deadlock [1], for delayed_uprobe_add() from update_ref_ctr() calls
kzalloc(GFP_KERNEL) with delayed_uprobe_lock held, and
uprobe_clear_state() from __mmput() also holds delayed_uprobe_lock.
Commit a1b2289cef ("android: binder: drop lru lock in isolate
callback") replaced mmput() with mmput_async() in order to avoid sleeping
with spinlock held. But this patch replaces mmput() with mmput_async() in
order not to start __mmput() from shrinker context.
[1] https://syzkaller.appspot.com/bug?id=bc9e7303f537c41b2b0cc2dfcea3fc42964c2d45
Reported-by: syzbot <syzbot+1068f09c44d151250c33@syzkaller.appspotmail.com>
Reported-by: syzbot <syzbot+e5344baa319c9a96edec@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reviewed-by: Michal Hocko <mhocko@suse.com>
Acked-by: Todd Kjos <tkjos@google.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/4ba9adb2-43f5-2de0-22de-f6075c1fab50@i-love.sakura.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Add vendor hooks for vendor-specific scheduling.
android_rvh_select_task_rq_rt:
To perform vendor-specific RT task placement.
android_rvh_select_fallback_rq:
To restrict cpu usage.
android_rvh_scheduler_tick:
To collect periodic scheduling information and to schedule tasks.
android_rvh_enqueue_tas/android_rvh_dequeue_task:
For vendor to be aware of the task schedule in/out.
android_rvh_can_migrate_task:
To limit task migration based on vendor requirements.
android_rvh_find_lowest_rq:
To find the lowest rq for RT task with vendor-specific way.
Bug: 155241766
Change-Id: I926458b0a911d564e5932e200125b12406c2deee
Signed-off-by: Park Bumgyu <bumgyu.park@samsung.com>
- To use fpsimd in kernel task, vendor_hook call is needed to
save/restore fpsimd at scheduling time.
- ANDROID_VENDOR_DATA added to thread_struct.
- Vendor_hooks is called when thread is switching for save/restore
fpsimd states.
(trace_android_vh_is_fpsimd_save(prev, next))
Bug: 149632552
Signed-off-by: Wooyeon Kim <wooy88.kim@samsung.com>
Change-Id: I853e1b6a9a51e24f770423bbc39fdd84265d78fc
For modifying task placement policy, we add the hook on the top of
select_task_rq_fair(). It allows us to modify wakeup/fork/exec balance
paths.
Bug: 158263250
Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: I80ff870453472e183ab2aae7381bff91e49ae296
The binder driver makes the assumption proc->context pointer is invariant after
initialization (as documented in the kerneldoc header for struct proc).
However, in commit f0fe2c0f05 ("binder: prevent UAF for binderfs devices II")
proc->context is set to NULL during binder_deferred_release().
Another proc was in the middle of setting up a transaction to the dying
process and crashed on a NULL pointer deref on "context" which is a local
set to &proc->context:
new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
Here's the stack:
[ 5237.855435] Call trace:
[ 5237.855441] binder_get_ref_for_node_olocked+0x100/0x2ec
[ 5237.855446] binder_inc_ref_for_node+0x140/0x280
[ 5237.855451] binder_translate_binder+0x1d0/0x388
[ 5237.855456] binder_transaction+0x2228/0x3730
[ 5237.855461] binder_thread_write+0x640/0x25bc
[ 5237.855466] binder_ioctl_write_read+0xb0/0x464
[ 5237.855471] binder_ioctl+0x30c/0x96c
[ 5237.855477] do_vfs_ioctl+0x3e0/0x700
[ 5237.855482] __arm64_sys_ioctl+0x78/0xa4
[ 5237.855488] el0_svc_common+0xb4/0x194
[ 5237.855493] el0_svc_handler+0x74/0x98
[ 5237.855497] el0_svc+0x8/0xc
The fix is to move the kfree of the binder_device to binder_free_proc()
so the binder_device is freed when we know there are no references
remaining on the binder_proc.
Fixes: f0fe2c0f05 ("binder: prevent UAF for binderfs devices II")
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200622200715.114382-1-tkjos@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Since commit 84af7a6194 ("checkpatch: kconfig: prefer 'help' over
'---help---'"), the number of '---help---' has been gradually
decreasing, but there are still more than 2400 instances.
This commit finishes the conversion. While I touched the lines,
I also fixed the indentation.
There are a variety of indentation styles found.
a) 4 spaces + '---help---'
b) 7 spaces + '---help---'
c) 8 spaces + '---help---'
d) 1 space + 1 tab + '---help---'
e) 1 tab + '---help---' (correct indentation)
f) 1 tab + 1 space + '---help---'
g) 1 tab + 2 spaces + '---help---'
In order to convert all of them to 1 tab + 'help', I ran the
following commend:
$ find . -name 'Kconfig*' | xargs sed -i 's/^[[:space:]]*---help---/\thelp/'
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
New vendor hook files cite Google, Inc instead of Google LLC
Fixes: 7f62740112 ("ANDROID: add support for vendor hooks")
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: If42762c4bbe6d0a7ff1cc75b64a3b224902e121c
Add support for vendor hooks. Adds include/trace/hooks
directory for trace definition headers where hooks
can be defined and vendor_hook.c for instantiating
and exporting them for vendor modules.
There are two variants of vendor hooks, both based
on tracepoints:
Normal: this uses the DECLARE_HOOK macro
to create a tracepoint function with the name trace_<name>
where <name> is the unique identifier for the trace.
Restricted: restricted hooks are needed for cases like
scheduler hooks where the attached function must be
called even if the cpu is offline or requires a
non-atomic context. Restricted vendor hooks cannot
be detached, so modules that attach to a restricted
hook can never unload. Also, only 1 attachment is
allowed (any other attempts to attach will fail with
-EBUSY).
For either case, modules attach to the hook by using
register_trace_<name>(func_ptr, NULL).
New hooks should be defined in headers in the
include/trace/hooks/ directory using the
DECLARE_HOOK() or DECLARE_RESTRICTED_HOOK()
macros.
New files added to include/trace/hooks should
be #include'd from drivers/android/vendor_hooks.c.
The EXPORT_TRACEPOINT_SYMBOL_GPL() should be
also added to drivers/android/vendor_hooks.c.
For example, if a new hook, 'android_vh_foo(int &ret)'
is added in do_exit() in exit.c, these changes are
needed:
1. create a new header file include/trace/hooks/foo.h
which contains:
#include <trace/hooks/vendor_hooks.h>
...
DECLARE_HOOK(android_vh_foo,
TP_PROTO(int *retp),
TP_ARGS(retp);
2. in exit.c, add
#include <trace/hooks/foo.h>
...
int ret = 0;
...
android_vh_foo(&ret);
if (ret)
return ret;
...
3. in drivers/android/vendor_hooks.c, add
#include <trace/hooks/foo.h>
...
EXPORT_TRACEPOINT_SYMBOL_GPL(android_vh_foo);
The hook can then be attached by adding the registration code
to the module:
#include <trace/hooks/sched.h>
...
static void my_foo(int *retp)
{
*retp = 0;
}
...
rc = register_trace_android_vh_sched_exit(my_foo, NULL);
Bug: 156285741
Signed-off-by: Todd Kjos <tkjos@google.com>
Change-Id: I6a7d1c8919dae91c965e2a0450df50eac2d282db
The pointer ctx is being initialized with a value that is never read
and it is being updated later with a new value. The initialization
is redundant and can be removed.
Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Link: https://lore.kernel.org/r/20200402105000.506296-1-colin.king@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit aefd2d632e.
This patch introduced a race condition reported by Pete Zhang
<pete.zhang@nxp.com> where a thread already selected to handle a
transaction could be selected again by a different client. The signature
was triggering of the WARN_ON() in binder_enqueue_thread_work_ilocked():
static void
binder_enqueue_thread_work_ilocked(...)
{
WARN_ON(!list_empty(&thread->waiting_thread_node));
...
}
which indicates that a thread is unexpectedly enqueued
as a waiting thread when it has been selected and work is
being assigned to it.
There was a 2nd issue introduced by the same patch that could,
at least in theory, cause async transactions to hang.
Bug: 151861772
Change-Id: I0c2bdb4c4a0d57caae1551bcbb4c31a8e09e024b
Signed-off-by: Todd Kjos <tkjos@google.com>
When I first wrote binderfs the new mount api had not yet landed. Now
that it has been around for a little while and a bunch of filesystems
have already been ported we should do so too. When Al sent his
mount-api-conversion pr he requested that binderfs (and a few others) be
ported separately. It's time we port binderfs. We can make use of the
new option parser, get nicer infrastructure and it will be easier if we
ever add any new mount options.
This survives testing with the binderfs selftests:
for i in `seq 1 1000`; do ./binderfs_test; done
including the new stress tests I sent out for review today:
TAP version 13
1..1
# selftests: filesystems/binderfs: binderfs_test
# [==========] Running 3 tests from 1 test cases.
# [ RUN ] global.binderfs_stress
# [ XFAIL! ] Tests are not run as root. Skipping privileged tests
# [==========] Running 3 tests from 1 test cases.
# [ RUN ] global.binderfs_stress
# [ OK ] global.binderfs_stress
# [ RUN ] global.binderfs_test_privileged
# [ OK ] global.binderfs_test_privileged
# [ RUN ] global.binderfs_test_unprivileged
# # Allocated new binder device with major 243, minor 4, and name my-binder
# # Detected binder version: 8
# [==========] Running 3 tests from 1 test cases.
# [ RUN ] global.binderfs_stress
# [ OK ] global.binderfs_stress
# [ RUN ] global.binderfs_test_privileged
# [ OK ] global.binderfs_test_privileged
# [ RUN ] global.binderfs_test_unprivileged
# [ OK ] global.binderfs_test_unprivileged
# [==========] 3 / 3 tests passed.
# [ PASSED ]
ok 1 selftests: filesystems/binderfs: binderfs_test
Cc: Todd Kjos <tkjos@google.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20200313153427.141789-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Binderfs binder-control devices are cleaned up via binderfs_evict_inode
too() which will use refcount_dec_and_test(). However, we missed to set
the refcount for binderfs binder-control devices and so we underflowed
when the binderfs instance got unmounted. Pretty obvious oversight and
should have been part of the more general UAF fix. The good news is that
having test cases (suprisingly) helps.
Technically, we could detect that we're about to cleanup the
binder-control dentry in binderfs_evict_inode() and then simply clean it
up. But that makes the assumption that the binder driver itself will
never make use of a binderfs binder-control device after the binderfs
instance it belongs to has been unmounted and the superblock for it been
destroyed. While it is unlikely to ever come to this let's be on the
safe side. Performance-wise this also really doesn't matter since the
binder-control device is only every really when creating the binderfs
filesystem or creating additional binder devices. Both operations are
pretty rare.
Fixes: f0fe2c0f05 ("binder: prevent UAF for binderfs devices II")
Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This is a necessary follow up to the first fix I proposed and we merged
in 2669b8b0c7 ("binder: prevent UAF for binderfs devices"). I have been
overly optimistic that the simple fix I proposed would work. But alas,
ihold() + iput() won't work since the inodes won't survive the
destruction of the superblock.
So all we get with my prior fix is a different race with a tinier
race-window but it doesn't solve the issue. Fwiw, the problem lies with
generic_shutdown_super(). It even has this cozy Al-style comment:
if (!list_empty(&sb->s_inodes)) {
printk("VFS: Busy inodes after unmount of %s. "
"Self-destruct in 5 seconds. Have a nice day...\n",
sb->s_id);
}
On binder_release(), binder_defer_work(proc, BINDER_DEFERRED_RELEASE) is
called which punts the actual cleanup operation to a workqueue. At some
point, binder_deferred_func() will be called which will end up calling
binder_deferred_release() which will retrieve and cleanup the
binder_context attach to this struct binder_proc.
If we trace back where this binder_context is attached to binder_proc we
see that it is set in binder_open() and is taken from the struct
binder_device it is associated with. This obviously assumes that the
struct binder_device that context is attached to is _never_ freed. While
that might be true for devtmpfs binder devices it is most certainly
wrong for binderfs binder devices.
So, assume binder_open() is called on a binderfs binder devices. We now
stash away the struct binder_context associated with that struct
binder_devices:
proc->context = &binder_dev->context;
/* binderfs stashes devices in i_private */
if (is_binderfs_device(nodp)) {
binder_dev = nodp->i_private;
info = nodp->i_sb->s_fs_info;
binder_binderfs_dir_entry_proc = info->proc_log_dir;
} else {
.
.
.
proc->context = &binder_dev->context;
Now let's assume that the binderfs instance for that binder devices is
shutdown via umount() and/or the mount namespace associated with it goes
away. As long as there is still an fd open for that binderfs binder
device things are fine. But let's assume we now close the last fd for
that binderfs binder device. Now binder_release() is called and punts to
the workqueue. Assume that the workqueue has quite a bit of stuff to do
and doesn't get to cleaning up the struct binder_proc and the associated
struct binder_context with it for that binderfs binder device right
away. In the meantime, the VFS is killing the super block and is
ultimately calling sb->evict_inode() which means it will call
binderfs_evict_inode() which does:
static void binderfs_evict_inode(struct inode *inode)
{
struct binder_device *device = inode->i_private;
struct binderfs_info *info = BINDERFS_I(inode);
clear_inode(inode);
if (!S_ISCHR(inode->i_mode) || !device)
return;
mutex_lock(&binderfs_minors_mutex);
--info->device_count;
ida_free(&binderfs_minors, device->miscdev.minor);
mutex_unlock(&binderfs_minors_mutex);
kfree(device->context.name);
kfree(device);
}
thereby freeing the struct binder_device including struct
binder_context.
Now the workqueue finally has time to get around to cleaning up struct
binder_proc and is now trying to access the associate struct
binder_context. Since it's already freed it will OOPs.
Fix this by introducing a refounct on binder devices.
This is an alternative fix to 51d8a7eca6 ("binder: prevent UAF read in
print_binder_transaction_log_entry()").
Fixes: 3ad20fe393 ("binder: implement binderfs")
Fixes: 2669b8b0c7 ("binder: prevent UAF for binderfs devices")
Fixes: 03e2e07e38 ("binder: Make transaction_log available in binderfs")
Related : 51d8a7eca6 ("binder: prevent UAF read in print_binder_transaction_log_entry()")
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200303164340.670054-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Todd Kjos