summaryrefslogtreecommitdiff
path: root/include/linux/fdtable.h
diff options
context:
space:
mode:
authorTodd Kjos <tkjos@android.com>2018-12-15 02:58:21 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2018-12-19 11:40:13 +0300
commit80cd795630d6526ba729a089a435bf74a57af927 (patch)
treebc1d2b779bf5e506c66f96ee2210101c17652b59 /include/linux/fdtable.h
parent2701e804f00f79823f69f37c87fef171ac345484 (diff)
downloadlinux-80cd795630d6526ba729a089a435bf74a57af927.tar.xz
binder: fix use-after-free due to ksys_close() during fdget()
44d8047f1d8 ("binder: use standard functions to allocate fds") exposed a pre-existing issue in the binder driver. fdget() is used in ksys_ioctl() as a performance optimization. One of the rules associated with fdget() is that ksys_close() must not be called between the fdget() and the fdput(). There is a case where this requirement is not met in the binder driver which results in the reference count dropping to 0 when the device is still in use. This can result in use-after-free or other issues. If userpace has passed a file-descriptor for the binder driver using a BINDER_TYPE_FDA object, then kys_close() is called on it when handling a binder_ioctl(BC_FREE_BUFFER) command. This violates the assumptions for using fdget(). The problem is fixed by deferring the close using task_work_add(). A new variant of __close_fd() was created that returns a struct file with a reference. The fput() is deferred instead of using ksys_close(). Fixes: 44d8047f1d87a ("binder: use standard functions to allocate fds") Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux/fdtable.h')
-rw-r--r--include/linux/fdtable.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index 41615f38bcff..f07c55ea0c22 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -121,6 +121,7 @@ extern void __fd_install(struct files_struct *files,
unsigned int fd, struct file *file);
extern int __close_fd(struct files_struct *files,
unsigned int fd);
+extern int __close_fd_get_file(unsigned int fd, struct file **res);
extern struct kmem_cache *files_cachep;