A mirror of the official Linux kernel repository just in case
Go to file
Christian Brauner 211b64e4b5 binderfs: use refcount for binder control devices too
Binderfs binder-control devices are cleaned up via binderfs_evict_inode
too() which will use refcount_dec_and_test(). However, we missed to set
the refcount for binderfs binder-control devices and so we underflowed
when the binderfs instance got unmounted. Pretty obvious oversight and
should have been part of the more general UAF fix. The good news is that
having test cases (suprisingly) helps.

Technically, we could detect that we're about to cleanup the
binder-control dentry in binderfs_evict_inode() and then simply clean it
up. But that makes the assumption that the binder driver itself will
never make use of a binderfs binder-control device after the binderfs
instance it belongs to has been unmounted and the superblock for it been
destroyed. While it is unlikely to ever come to this let's be on the
safe side. Performance-wise this also really doesn't matter since the
binder-control device is only every really when creating the binderfs
filesystem or creating additional binder devices. Both operations are
pretty rare.

Fixes: f0fe2c0f05 ("binder: prevent UAF for binderfs devices II")
Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-03-11 19:33:52 +01:00
arch ARM: SoC fixes 2020-03-08 17:36:22 -07:00
block block, bfq: fix overwrite of bfq_group pointer in bfq_find_set_group() 2020-03-06 07:00:58 -07:00
certs certs: Add wrapper function to check blacklisted binary hash 2019-11-12 12:25:50 +11:00
crypto Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity 2020-02-20 15:15:16 -08:00
Documentation ARM: SoC fixes 2020-03-08 17:36:22 -07:00
drivers binderfs: use refcount for binder control devices too 2020-03-11 19:33:52 +01:00
fs Driver core / debugfs fixes for 5.6-rc5 2020-03-08 10:39:40 -05:00
include Driver core / debugfs fixes for 5.6-rc5 2020-03-08 10:39:40 -05:00
init Tracing updates: 2020-02-26 10:34:42 -08:00
ipc Revert "ipc,sem: remove uneeded sem_undo_list lock usage in exit_sem()" 2020-02-21 11:22:15 -08:00
kernel block-5.6-2020-03-07 2020-03-07 14:14:38 -06:00
lib Tracing updates: 2020-02-26 10:34:42 -08:00
LICENSES LICENSES: Rename other to deprecated 2019-05-03 06:34:32 -06:00
mm mm, hotplug: fix page online with DEBUG_PAGEALLOC compiled but not enabled 2020-03-06 07:06:09 -06:00
net vsock: fix potential deadlock in transport->release() 2020-02-27 12:03:56 -08:00
samples Kbuild updates for v5.6 (2nd) 2020-02-09 16:05:50 -08:00
scripts parse-maintainers: Mark as executable 2020-03-06 16:29:21 -06:00
security Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity 2020-02-20 15:15:16 -08:00
sound ASoC: Fixes for v5.6 2020-03-07 07:24:36 +01:00
tools for-linus-2020-03-07 2020-03-07 08:01:43 -06:00
usr Kbuild updates for v5.6 (2nd) 2020-02-09 16:05:50 -08:00
virt KVM/arm fixes for 5.6, take #1 2020-02-28 11:50:06 +01:00
.clang-format clang-format: Update with the latest for_each macro list 2019-08-31 10:00:51 +02:00
.cocciconfig
.get_maintainer.ignore Opt out of scripts/get_maintainer.pl 2019-05-16 10:53:40 -07:00
.gitattributes .gitattributes: use 'dts' diff driver for dts files 2019-12-04 19:44:11 -08:00
.gitignore selftest/lkdtm: Use local .gitignore 2020-03-02 08:39:39 -07:00
.mailmap A handful of small documentation fixes that wandered in. 2020-02-07 13:03:10 -08:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Hand MIPS over to Thomas 2020-02-24 22:43:18 -08:00
Kbuild kbuild: rename hostprogs-y/always to hostprogs/always-y 2020-02-04 01:53:07 +09:00
Kconfig docs: kbuild: convert docs to ReST and rename to *.rst 2019-06-14 14:21:21 -06:00
MAINTAINERS ARM: SoC fixes 2020-03-08 17:36:22 -07:00
Makefile Linux 5.6-rc5 2020-03-08 17:44:44 -07:00
README Drop all 00-INDEX files from Documentation/ 2018-09-09 15:08:58 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.