• Todd Kjos's avatar
    binder: fix use-after-free due to ksys_close() during fdget() · 27564d8d
    Todd Kjos authored
    commit 80cd7956 upstream.
    44d8047f ("binder: use standard functions to allocate fds")
    exposed a pre-existing issue in the binder driver.
    fdget() is used in ksys_ioctl() as a performance optimization.
    One of the rules associated with fdget() is that ksys_close() must
    not be called between the fdget() and the fdput(). There is a case
    where this requirement is not met in the binder driver which results
    in the reference count dropping to 0 when the device is still in
    use. This can result in use-after-free or other issues.
    If userpace has passed a file-descriptor for the binder driver using
    a BINDER_TYPE_FDA object, then kys_close() is called on it when
    handling a binder_ioctl(BC_FREE_BUFFER) command. This violates
    the assumptions for using fdget().
    The problem is fixed by deferring the close using task_work_add(). A
    new variant of __close_fd() was created that returns a struct file
    with a reference. The fput() is deferred instead of using ksys_close().
    Fixes: 44d8047f ("binder: use standard functions to allocate fds")
    Suggested-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
fdtable.h 3.34 KB