From: Sasha Levin Date: Sat, 9 Dec 2023 11:50:51 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v6.6.6~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=daede797763605a53714641a921d515b97d04e22;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/binder-fix-memory-leaks-of-spam-and-pending-work.patch b/queue-6.1/binder-fix-memory-leaks-of-spam-and-pending-work.patch new file mode 100644 index 00000000000..c3618f33e6f --- /dev/null +++ b/queue-6.1/binder-fix-memory-leaks-of-spam-and-pending-work.patch @@ -0,0 +1,77 @@ +From 5eca80821d0663ebe696a331438586ed74dabb74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 03:49:23 +0000 +Subject: binder: fix memory leaks of spam and pending work + +From: Carlos Llamas + +commit 1aa3aaf8953c84bad398adf6c3cabc9d6685bf7d upstream + +A transaction complete work is allocated and queued for each +transaction. Under certain conditions the work->type might be marked as +BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT to notify userspace about +potential spamming threads or as BINDER_WORK_TRANSACTION_PENDING when +the target is currently frozen. + +However, these work types are not being handled in binder_release_work() +so they will leak during a cleanup. This was reported by syzkaller with +the following kmemleak dump: + +BUG: memory leak +unreferenced object 0xffff88810e2d6de0 (size 32): + comm "syz-executor338", pid 5046, jiffies 4294968230 (age 13.590s) + hex dump (first 32 bytes): + e0 6d 2d 0e 81 88 ff ff e0 6d 2d 0e 81 88 ff ff .m-......m-..... + 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114 + [] kmalloc include/linux/slab.h:599 [inline] + [] kzalloc include/linux/slab.h:720 [inline] + [] binder_transaction+0x573/0x4050 drivers/android/binder.c:3152 + [] binder_thread_write+0x6b5/0x1860 drivers/android/binder.c:4010 + [] binder_ioctl_write_read drivers/android/binder.c:5066 [inline] + [] binder_ioctl+0x1b2c/0x3cf0 drivers/android/binder.c:5352 + [] vfs_ioctl fs/ioctl.c:51 [inline] + [] __do_sys_ioctl fs/ioctl.c:871 [inline] + [] __se_sys_ioctl fs/ioctl.c:857 [inline] + [] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857 + [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 + [] entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fix the leaks by kfreeing these work types in binder_release_work() and +handle them as a BINDER_WORK_TRANSACTION_COMPLETE cleanup. + +Cc: stable@vger.kernel.org +Fixes: a7dc1e6f99df ("binder: tell userspace to dump current backtrace when detected oneway spamming") +Reported-by: syzbot+7f10c1653e35933c0f1e@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=7f10c1653e35933c0f1e +Suggested-by: Alice Ryhl +Signed-off-by: Carlos Llamas +Reviewed-by: Alice Ryhl +Acked-by: Todd Kjos +Link: https://lore.kernel.org/r/20230922175138.230331-1-cmllamas@google.com +Signed-off-by: Greg Kroah-Hartman +[cmllamas: backport to v6.1 by dropping BINDER_WORK_TRANSACTION_PENDING + as commit 0567461a7a6e is not present. Remove fixes tag accordingly.] +Signed-off-by: Carlos Llamas +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index e4a6da81cd4b3..9cc3a2b1b4fc1 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -4788,6 +4788,7 @@ static void binder_release_work(struct binder_proc *proc, + "undelivered TRANSACTION_ERROR: %u\n", + e->cmd); + } break; ++ case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT: + case BINDER_WORK_TRANSACTION_COMPLETE: { + binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, + "undelivered TRANSACTION_COMPLETE\n"); +-- +2.42.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 1b9113bae08..04c6ae21a5b 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -133,3 +133,4 @@ arm64-dts-mediatek-mt8195-fix-pm-suspend-resume-with-venc-clocks.patch arm64-dts-mediatek-mt8183-fix-unit-address-for-scp-reserved-memory.patch arm64-dts-mediatek-mt8183-move-thermal-zones-to-the-root-node.patch arm64-dts-mediatek-mt8183-evb-fix-unit_address_vs_reg-warning-on-ntc.patch +binder-fix-memory-leaks-of-spam-and-pending-work.patch