On Fri, Nov 9, 2018 at 4:32 AM Greg KH gregkh@linuxfoundation.org wrote:
On Tue, Nov 06, 2018 at 03:55:32PM -0800, Todd Kjos wrote:
Malicious code can attempt to free buffers using the BC_FREE_BUFFER ioctl to binder. There are protections against a user freeing a buffer while in use by the kernel, however there was a window where BC_FREE_BUFFER could be used to free a recently allocated buffer that was not completely initialized. This resulted in a use-after-free detected by KASAN with a malicious test program.
This window is closed by setting the buffer's allow_user_free attribute to 0 when the buffer is allocated or when the user has previously freed it instead of waiting for the caller to set it. The problem was that when the struct buffer was recycled, allow_user_free was stale and set to 1 allowing a free to go through.
Signed-off-by: Todd Kjos tkjos@google.com Acked-by: Arve Hjønnevåg arve@android.com
No "stable" tag here? Any idea how far back the stable backporting should go, if any?
Sorry about that. It should be backported to 4.14 and later.
thanks,
greg k-h