android: drivers: workaround debugfs race in binder
If a /d/binder/proc/[pid] entry is kept open after linux has torn down the associated process, binder_proc_show can deference an invalid binder_proc that has been stashed in the debugfs inode. Validate that the binder_proc ptr passed into binder_proc_show has not been freed by looking for it within the global process list whilst the global lock is held. If the ptr is not valid, print nothing. Bug 19587483 Change-Id: Ice878c171db51ef9a4879c2f9299a2deb873d255 Signed-off-by: Riley Andrews <riandrews@android.com> Git-commit: 67680c141957991b9350269a8eaf30baf1c85427 Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by: Kaushal Kumar <kaushalk@codeaurora.org>
This commit is contained in:
parent
fd63d742b1
commit
a87a7ede4c
|
@ -3584,13 +3584,24 @@ static int binder_transactions_show(struct seq_file *m, void *unused)
|
|||
|
||||
static int binder_proc_show(struct seq_file *m, void *unused)
|
||||
{
|
||||
struct binder_proc *itr;
|
||||
struct binder_proc *proc = m->private;
|
||||
int do_lock = !binder_debug_no_lock;
|
||||
bool valid_proc = false;
|
||||
|
||||
if (do_lock)
|
||||
binder_lock(__func__);
|
||||
seq_puts(m, "binder proc state:\n");
|
||||
print_binder_proc(m, proc, 1);
|
||||
|
||||
hlist_for_each_entry(itr, &binder_procs, proc_node) {
|
||||
if (itr == proc) {
|
||||
valid_proc = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (valid_proc) {
|
||||
seq_puts(m, "binder proc state:\n");
|
||||
print_binder_proc(m, proc, 1);
|
||||
}
|
||||
if (do_lock)
|
||||
binder_unlock(__func__);
|
||||
return 0;
|
||||
|
|
Loading…
Reference in New Issue