Skip to content

Commit 44e602b

Browse files
howlettakpm00
authored andcommitted
binder_alloc: add missing mmap_lock calls when using the VMA
Take the mmap_read_lock() when using the VMA in binder_alloc_print_pages() and when checking for a VMA in binder_alloc_new_buf_locked(). It is worth noting binder_alloc_new_buf_locked() drops the VMA read lock after it verifies a VMA exists, but may be taken again deeper in the call stack, if necessary. Link: https://lkml.kernel.org/r/20220810160209.1630707-1-Liam.Howlett@oracle.com Fixes: a43cfc8 (android: binder: stop saving a pointer to the VMA) Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com> Reported-by: Ondrej Mosnacek <omosnace@redhat.com> Reported-by: <syzbot+a7b60a176ec13cafb793@syzkaller.appspotmail.com> Acked-by: Carlos Llamas <cmllamas@google.com> Tested-by: Ondrej Mosnacek <omosnace@redhat.com> Cc: Minchan Kim <minchan@kernel.org> Cc: Christian Brauner (Microsoft) <brauner@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hridya Valsaraju <hridya@google.com> Cc: Joel Fernandes <joel@joelfernandes.org> Cc: Martijn Coenen <maco@android.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Todd Kjos <tkjos@android.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: "Arve Hjønnevåg" <arve@android.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
1 parent fcab34b commit 44e602b

File tree

1 file changed

+21
-10
lines changed

1 file changed

+21
-10
lines changed

drivers/android/binder_alloc.c

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -402,12 +402,15 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
402402
size_t size, data_offsets_size;
403403
int ret;
404404

405+
mmap_read_lock(alloc->vma_vm_mm);
405406
if (!binder_alloc_get_vma(alloc)) {
407+
mmap_read_unlock(alloc->vma_vm_mm);
406408
binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
407409
"%d: binder_alloc_buf, no vma\n",
408410
alloc->pid);
409411
return ERR_PTR(-ESRCH);
410412
}
413+
mmap_read_unlock(alloc->vma_vm_mm);
411414

412415
data_offsets_size = ALIGN(data_size, sizeof(void *)) +
413416
ALIGN(offsets_size, sizeof(void *));
@@ -929,17 +932,25 @@ void binder_alloc_print_pages(struct seq_file *m,
929932
* Make sure the binder_alloc is fully initialized, otherwise we might
930933
* read inconsistent state.
931934
*/
932-
if (binder_alloc_get_vma(alloc) != NULL) {
933-
for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
934-
page = &alloc->pages[i];
935-
if (!page->page_ptr)
936-
free++;
937-
else if (list_empty(&page->lru))
938-
active++;
939-
else
940-
lru++;
941-
}
935+
936+
mmap_read_lock(alloc->vma_vm_mm);
937+
if (binder_alloc_get_vma(alloc) == NULL) {
938+
mmap_read_unlock(alloc->vma_vm_mm);
939+
goto uninitialized;
942940
}
941+
942+
mmap_read_unlock(alloc->vma_vm_mm);
943+
for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
944+
page = &alloc->pages[i];
945+
if (!page->page_ptr)
946+
free++;
947+
else if (list_empty(&page->lru))
948+
active++;
949+
else
950+
lru++;
951+
}
952+
953+
uninitialized:
943954
mutex_unlock(&alloc->mutex);
944955
seq_printf(m, " pages: %d:%d:%d\n", active, lru, free);
945956
seq_printf(m, " pages high watermark: %zu\n", alloc->pages_high);

0 commit comments

Comments
 (0)