From e30c8f0424d678b60bce05da0db73b982a84b031 Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Fri, 18 Oct 2019 22:56:31 +0200 Subject: [PATCH] binder: Handle start==NULL in binder_update_page_range() commit 2a9edd056ed4fbf9d2e797c3fc06335af35bccc4 upstream. The old loop wouldn't stop when reaching `start` if `start==NULL`, instead continuing backwards to index -1 and crashing. Luckily you need to be highly privileged to map things at NULL, so it's not a big problem. Fix it by adjusting the loop so that the loop variable is always in bounds. This patch is deliberately minimal to simplify backporting, but IMO this function could use a refactor. The jump labels in the second loop body are horrible (the error gotos should be jumping to free_range instead), and both loops would look nicer if they just iterated upwards through indices. And the up_read()+mmput() shouldn't be duplicated like that. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Change-Id: I4ad9023a3a40e1a6afdeb01a0bcee6a12e667a47 Signed-off-by: Jann Horn Acked-by: Christian Brauner Link: https://lore.kernel.org/r/20191018205631.248274-3-jannh@google.com Signed-off-by: Greg Kroah-Hartman [bwh: Backported to 3.16: There is no continue statement in the loop, so we only need to check the exit condition at the bottom] Signed-off-by: Ben Hutchings --- drivers/android/binder.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 52fa75875731..9e9d2475051a 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -738,8 +738,7 @@ static int __binder_update_page_range(struct binder_proc *proc, int allocate, return 0; free_range: - for (page_addr = end - PAGE_SIZE; page_addr >= start; - page_addr -= PAGE_SIZE) { + for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) { page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; if (vma) zap_page_range(vma, (uintptr_t)page_addr + @@ -750,7 +749,8 @@ err_map_kernel_failed: __free_page(*page); *page = NULL; err_alloc_page_failed: - ; + if (page_addr == start) + break; } err_no_vma: if (mm) {