queue-4.19/revert-binder-fix-handling-of-misaligned-binder-object.patch

   1 From tkjos@android.com  Thu Jun  6 09:17:35 2019
   2 From: Todd Kjos <tkjos@android.com>
   3 Date: Wed,  5 Jun 2019 09:38:24 -0700
   4 Subject: Revert "binder: fix handling of misaligned binder object"
   5 To: tkjos@google.com, gregkh@linuxfoundation.org, stable@vger.kernel.org
   6 Cc: ben.hutchings@codethink.co.uk, Alexander.Levin@microsoft.com
   7 Message-ID: <20190605163825.178537-1-tkjos@google.com>
   8
   9 From: Todd Kjos <tkjos@android.com>
  10
  11 This reverts commit 6bf7d3c5c0c5dad650bfc4345ed553c18b69d59e.
  12
  13 The commit message is for a different patch. Reverting and then adding
  14 the same patch back with the correct commit message.
  15
  16 Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
  17 Cc: stable <stable@vger.kernel.org> # 4.19
  18 Signed-off-by: Todd Kjos <tkjos@google.com>
  19 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  20 ---
  21  drivers/android/binder_alloc.c |   18 ++++++++++--------
  22  1 file changed, 10 insertions(+), 8 deletions(-)
  23
  24 --- a/drivers/android/binder_alloc.c
  25 +++ b/drivers/android/binder_alloc.c
  26 @@ -958,13 +958,14 @@ enum lru_status binder_alloc_free_page(s
  27
  28         index = page - alloc->pages;
  29         page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;
  30 -
  31 -       mm = alloc->vma_vm_mm;
  32 -       if (!mmget_not_zero(mm))
  33 -               goto err_mmget;
  34 -       if (!down_write_trylock(&mm->mmap_sem))
  35 -               goto err_down_write_mmap_sem_failed;
  36         vma = binder_alloc_get_vma(alloc);
  37 +       if (vma) {
  38 +               if (!mmget_not_zero(alloc->vma_vm_mm))
  39 +                       goto err_mmget;
  40 +               mm = alloc->vma_vm_mm;
  41 +               if (!down_write_trylock(&mm->mmap_sem))
  42 +                       goto err_down_write_mmap_sem_failed;
  43 +       }
  44
  45         list_lru_isolate(lru, item);
  46         spin_unlock(lock);
  47 @@ -977,9 +978,10 @@ enum lru_status binder_alloc_free_page(s
  48                                PAGE_SIZE);
  49
  50                 trace_binder_unmap_user_end(alloc, index);
  51 +
  52 +               up_write(&mm->mmap_sem);
  53 +               mmput(mm);
  54         }
  55 -       up_write(&mm->mmap_sem);
  56 -       mmput(mm);
  57
  58         trace_binder_unmap_kernel_start(alloc, index);
  59