aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRiley Andrews <riandrews@android.com>2015-05-28 12:10:05 -0700
committerRiley Andrews <riandrews@google.com>2015-10-14 17:14:50 -0700
commit015b66b618a8f78a0b6f756a9596c89627d17b5e (patch)
treeb47a87f4eea3bc917cc3f347cacb4928de9f52f7
parentfa266aa4f937538aac2eb2e722b32282dbfc9d3a (diff)
downloadlinux-linaro-stable-015b66b618a8f78a0b6f756a9596c89627d17b5e.tar.gz
android: drivers: workaround debugfs race in binder
If a /d/binder/proc/[pid] entry is kept open after linux has torn down the associated process, binder_proc_show can deference an invalid binder_proc that has been stashed in the debugfs inode. Validate that the binder_proc ptr passed into binder_proc_show has not been freed by looking for it within the global process list whilst the global lock is held. If the ptr is not valid, print nothing. Bug 19587483 Change-Id: Ice878c171db51ef9a4879c2f9299a2deb873d255 Signed-off-by: Riley Andrews <riandrews@android.com>
-rw-r--r--drivers/staging/android/binder.c15
1 files changed, 13 insertions, 2 deletions
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 02ce86ce088c..183748919ba6 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -3591,13 +3591,24 @@ static int binder_transactions_show(struct seq_file *m, void *unused)
static int binder_proc_show(struct seq_file *m, void *unused)
{
+ struct binder_proc *itr;
struct binder_proc *proc = m->private;
int do_lock = !binder_debug_no_lock;
+ bool valid_proc = false;
if (do_lock)
binder_lock(__func__);
- seq_puts(m, "binder proc state:\n");
- print_binder_proc(m, proc, 1);
+
+ hlist_for_each_entry(itr, &binder_procs, proc_node) {
+ if (itr == proc) {
+ valid_proc = true;
+ break;
+ }
+ }
+ if (valid_proc) {
+ seq_puts(m, "binder proc state:\n");
+ print_binder_proc(m, proc, 1);
+ }
if (do_lock)
binder_unlock(__func__);
return 0;