diff options
| author | Riley Andrews <riandrews@android.com> | 2015-05-28 12:10:05 -0700 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2016-11-17 12:12:24 +0100 |
| commit | 25f8e0183de8e8acaefa979065004fa1ae6a4189 (patch) | |
| tree | 753229de25cececdb5fdfd8dfdf804d9f845c864 /drivers/android | |
| parent | 4aed4f5eb5d904dbd14b91e576baeabd20d6bd0a (diff) | |
android: drivers: workaround debugfs race in binder
If a /d/binder/proc/[pid] entry is kept open after linux has
torn down the associated process, binder_proc_show can deference
an invalid binder_proc that has been stashed in the debugfs
inode. Validate that the binder_proc ptr passed into binder_proc_show
has not been freed by looking for it within the global process list
whilst the global lock is held. If the ptr is not valid, print nothing.
Bug 19587483
Change-Id: Ice878c171db51ef9a4879c2f9299a2deb873d255
Signed-off-by: Riley Andrews <riandrews@android.com>
Diffstat (limited to 'drivers/android')
| -rw-r--r-- | drivers/android/binder.c | 26 |
1 files changed, 9 insertions, 17 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c index bb095ed42..a135929a5 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -5468,32 +5468,24 @@ static int binder_transactions_show(struct seq_file *m, void *unused) static int binder_proc_show(struct seq_file *m, void *unused) { + struct binder_proc *itr; struct binder_proc *proc = m->private; int do_lock = !binder_debug_no_lock; -#ifdef MTK_BINDER_DEBUG - struct binder_proc *tmp_proc; - bool find = false; -#endif + bool valid_proc = false; if (do_lock) binder_lock(__func__); - seq_puts(m, "binder proc state:\n"); -#ifdef MTK_BINDER_DEBUG - hlist_for_each_entry(tmp_proc, &binder_procs, proc_node) - { - if (proc == tmp_proc) - { - find = true; + + hlist_for_each_entry(itr, &binder_procs, proc_node) { + if (itr == proc) { + valid_proc = true; break; } } - if (find == true) -#endif + if (valid_proc) { + seq_puts(m, "binder proc state:\n"); print_binder_proc(m, proc, 1); -#ifdef MTK_BINDER_DEBUG - else - pr_debug("show proc addr 0x%p exit\n", proc); -#endif + } if (do_lock) binder_unlock(__func__); return 0; |