linux-kernel - [PATCH] binder: add mutex_lock for mmap and NULL when free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 7 Oct 2023 11:40:46 +0800
From:   Kassey Li <quic_yingangl@...cinc.com>
To:     <gregkh@...gle.com>, <gregkh@...uxfoundation.org>,
        <cmllamas@...gle.com>, <surenb@...gle.com>, <arve@...roid.com>,
        <joel@...lfernandes.org>, <brauner@...nel.org>
CC:     <tkjos@...roid.com>, <maco@...roid.com>,
        <quic_yingangl@...cinc.com>, <linux-kernel@...r.kernel.org>
Subject: [PATCH] binder: add mutex_lock for mmap and NULL when free

Enforce alloc->mutex in binder_alloc_mmap_handler when add
the entry to list.

Assign the freed pages/page_ptr to NULL to catch possible
use after free with NULL pointer access.

Signed-off-by: Kassey Li <quic_yingangl@...cinc.com>
---
 drivers/android/binder_alloc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index e3db8297095a..c7d126e04343 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -775,6 +775,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
 	}
 
 	buffer->user_data = alloc->buffer;
+	mutex_lock(&alloc->mutex);
 	list_add(&buffer->entry, &alloc->buffers);
 	buffer->free = 1;
 	binder_insert_free_buffer(alloc, buffer);
@@ -782,7 +783,7 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
 
 	/* Signal binder_alloc is fully initialized */
 	binder_alloc_set_vma(alloc, vma);
-
+	mutex_unlock(&alloc->mutex);
 	return 0;
 
 err_alloc_buf_struct_failed:
@@ -856,9 +857,11 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc)
 				     __func__, alloc->pid, i, page_addr,
 				     on_lru ? "on lru" : "active");
 			__free_page(alloc->pages[i].page_ptr);
+			alloc->pages[i].page_ptr = NULL;
 			page_count++;
 		}
 		kfree(alloc->pages);
+		alloc->pages = NULL;
 	}
 	mutex_unlock(&alloc->mutex);
 	if (alloc->mm)
-- 
2.25.1