binder: fix possible UAF when freeing buffer

There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.

Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 748ac489ef7ebd3c68949b0b30c37a77a43878a5..bc26b5511f0a9fd3b77ad28ecf18cfc26f3b342d 100644 (file)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1941,8 +1941,18 @@ static void binder_free_txn_fixups(struct binder_transaction *t)
 
 static void binder_free_transaction(struct binder_transaction *t)
 {
-       if (t->buffer)
-               t->buffer->transaction = NULL;
+       struct binder_proc *target_proc = t->to_proc;
+
+       if (target_proc) {
+               binder_inner_proc_lock(target_proc);
+               if (t->buffer)
+                       t->buffer->transaction = NULL;
+               binder_inner_proc_unlock(target_proc);
+       }
+       /*
+        * If the transaction has no target_proc, then
+        * t->buffer->transaction has already been cleared.
+        */
        binder_free_txn_fixups(t);
        kfree(t);
        binder_stats_deleted(BINDER_STAT_TRANSACTION);
@@ -3551,10 +3561,12 @@ err_invalid_target_handle:
 static void
 binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer)
 {
+       binder_inner_proc_lock(proc);
        if (buffer->transaction) {
                buffer->transaction->buffer = NULL;
                buffer->transaction = NULL;
        }
+       binder_inner_proc_unlock(proc);
        if (buffer->async_transaction && buffer->target_node) {
                struct binder_node *buf_node;
                struct binder_work *w;