summaryrefslogtreecommitdiff
path: root/drivers/nvmem/imx-iim.c
diff options
context:
space:
mode:
authorTodd Kjos <tkjos@android.com>2017-11-27 20:32:33 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-12-18 17:47:12 +0300
commit7f3dc0088b98533f17128058fac73cd8b2752ef1 (patch)
tree4bfb1d5f8b5356832a99e4c1abf96c05a668e638 /drivers/nvmem/imx-iim.c
parent869b5567e12f63ea7407f81728ca87f8c0abbfdb (diff)
downloadlinux-7f3dc0088b98533f17128058fac73cd8b2752ef1.tar.xz
binder: fix proc->files use-after-free
proc->files cleanup is initiated by binder_vma_close. Therefore a reference on the binder_proc is not enough to prevent the files_struct from being released while the binder_proc still has a reference. This can lead to an attempt to dereference the stale pointer obtained from proc->files prior to proc->files cleanup. This has been seen once in task_get_unused_fd_flags() when __alloc_fd() is called with a stale "files". The fix is to protect proc->files with a mutex to prevent cleanup while in use. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/nvmem/imx-iim.c')
0 files changed, 0 insertions, 0 deletions