4.14-stable patches

added patches:
	binder-fix-race-between-munmap-and-direct-reclaim.patch
	revert-binder-fix-handling-of-misaligned-binder-object.patch

diff --git a/queue-4.14/binder-fix-race-between-munmap-and-direct-reclaim.patch b/queue-4.14/binder-fix-race-between-munmap-and-direct-reclaim.patch
new file mode 100644 (file)
index 0000000..f8bd85c
--- /dev/null
+++ b/queue-4.14/binder-fix-race-between-munmap-and-direct-reclaim.patch
@@ -0,0 +1,70 @@
+From tkjos@android.com  Thu Jun  6 09:19:12 2019
+From: Todd Kjos <tkjos@android.com>
+Date: Wed,  5 Jun 2019 09:37:46 -0700
+Subject: binder: fix race between munmap() and direct reclaim
+To: tkjos@google.com, gregkh@linuxfoundation.org, stable@vger.kernel.org
+Cc: ben.hutchings@codethink.co.uk, Alexander.Levin@microsoft.com, Joel Fernandes <joel@joelfernandes.org>
+Message-ID: <20190605163746.178413-2-tkjos@google.com>
+
+From: Todd Kjos <tkjos@android.com>
+
+commit 5cec2d2e5839f9c0fec319c523a911e0a7fd299f upstream.
+
+An munmap() on a binder device causes binder_vma_close() to be called
+which clears the alloc->vma pointer.
+
+If direct reclaim causes binder_alloc_free_page() to be called, there
+is a race where alloc->vma is read into a local vma pointer and then
+used later after the mm->mmap_sem is acquired. This can result in
+calling zap_page_range() with an invalid vma which manifests as a
+use-after-free in zap_page_range().
+
+The fix is to check alloc->vma after acquiring the mmap_sem (which we
+were acquiring anyway) and skip zap_page_range() if it has changed
+to NULL.
+
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
+Cc: stable <stable@vger.kernel.org> # 4.14
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder_alloc.c |   18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -945,14 +945,13 @@ enum lru_status binder_alloc_free_page(s
+ 
+       index = page - alloc->pages;
+       page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
++
++      mm = alloc->vma_vm_mm;
++      if (!mmget_not_zero(mm))
++              goto err_mmget;
++      if (!down_write_trylock(&mm->mmap_sem))
++              goto err_down_write_mmap_sem_failed;
+       vma = binder_alloc_get_vma(alloc);
+-      if (vma) {
+-              if (!mmget_not_zero(alloc->vma_vm_mm))
+-                      goto err_mmget;
+-              mm = alloc->vma_vm_mm;
+-              if (!down_write_trylock(&mm->mmap_sem))
+-                      goto err_down_write_mmap_sem_failed;
+-      }
+ 
+       list_lru_isolate(lru, item);
+       spin_unlock(lock);
+@@ -965,10 +964,9 @@ enum lru_status binder_alloc_free_page(s
+                              PAGE_SIZE);
+ 
+               trace_binder_unmap_user_end(alloc, index);
+-
+-              up_write(&mm->mmap_sem);
+-              mmput(mm);
+       }
++      up_write(&mm->mmap_sem);
++      mmput(mm);
+ 
+       trace_binder_unmap_kernel_start(alloc, index);
+ 

diff --git a/queue-4.14/revert-binder-fix-handling-of-misaligned-binder-object.patch b/queue-4.14/revert-binder-fix-handling-of-misaligned-binder-object.patch
new file mode 100644 (file)
index 0000000..a56748b
--- /dev/null
+++ b/queue-4.14/revert-binder-fix-handling-of-misaligned-binder-object.patch
@@ -0,0 +1,59 @@
+From tkjos@android.com  Thu Jun  6 09:18:43 2019
+From: Todd Kjos <tkjos@android.com>
+Date: Wed,  5 Jun 2019 09:37:45 -0700
+Subject: Revert "binder: fix handling of misaligned binder object"
+To: tkjos@google.com, gregkh@linuxfoundation.org, stable@vger.kernel.org
+Cc: ben.hutchings@codethink.co.uk, Alexander.Levin@microsoft.com
+Message-ID: <20190605163746.178413-1-tkjos@google.com>
+
+From: Todd Kjos <tkjos@android.com>
+
+This reverts commit 33c6b9ca70a8b066a613e2a3d0331ae8f82aa31a.
+
+The commit message is for a different patch. Reverting and then adding
+the same patch back with the correct commit message.
+
+Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: stable <stable@vger.kernel.org> # 4.14
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder_alloc.c |   18 ++++++++++--------
+ 1 file changed, 10 insertions(+), 8 deletions(-)
+
+--- a/drivers/android/binder_alloc.c
++++ b/drivers/android/binder_alloc.c
+@@ -945,13 +945,14 @@ enum lru_status binder_alloc_free_page(s
+ 
+       index = page - alloc->pages;
+       page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
+-
+-      mm = alloc->vma_vm_mm;
+-      if (!mmget_not_zero(mm))
+-              goto err_mmget;
+-      if (!down_write_trylock(&mm->mmap_sem))
+-              goto err_down_write_mmap_sem_failed;
+       vma = binder_alloc_get_vma(alloc);
++      if (vma) {
++              if (!mmget_not_zero(alloc->vma_vm_mm))
++                      goto err_mmget;
++              mm = alloc->vma_vm_mm;
++              if (!down_write_trylock(&mm->mmap_sem))
++                      goto err_down_write_mmap_sem_failed;
++      }
+ 
+       list_lru_isolate(lru, item);
+       spin_unlock(lock);
+@@ -964,9 +965,10 @@ enum lru_status binder_alloc_free_page(s
+                              PAGE_SIZE);
+ 
+               trace_binder_unmap_user_end(alloc, index);
++
++              up_write(&mm->mmap_sem);
++              mmput(mm);
+       }
+-      up_write(&mm->mmap_sem);
+-      mmput(mm);
+ 
+       trace_binder_unmap_kernel_start(alloc, index);
+ 

diff --git a/queue-4.14/series b/queue-4.14/series
index 23427f171866f209cd487c09092d8eec857728ec..dd5f0c138796c7d241672e8eb20a10a00272b523 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -64,3 +64,5 @@ drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch
 compiler-attributes-add-support-for-__copy-gcc-9.patch
 include-linux-module.h-copy-__init-__exit-attrs-to-init-cleanup_module.patch
 revert-x86-build-move-_etext-to-actual-end-of-.text.patch
+revert-binder-fix-handling-of-misaligned-binder-object.patch
+binder-fix-race-between-munmap-and-direct-reclaim.patch