Revision history [back]

CVE-2019-2215

commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.

binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits.

File affected: kernel-adaptation-sbj-3.4.108.20181002.1/drivers/staging/android/binder.c lines 2629-2644

Fix is available and should look like:

                t = t->to_parent;
        } else if (t->from == thread) {
            t->from = NULL;
            t = t->from_parent;
        } else
            BUG();
    }
+       
+   /*
+    * If this thread used poll, make sure we remove the waitqueue  
+    * from any epoll data structures holding it with POLLFREE. 
+    * waitqueue_active() is safe to use here because we're holding 
+    * the inner lock.  
+    */ 
+   if ((thread->looper & BINDER_LOOPER_STATE_NEED_RETURN) &&
+       waitqueue_active(&thread->wait)) {  
+       wake_up_poll(&thread->wait, POLLHUP | POLLFREE);    
+   }
+   
    if (send_reply)
        binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
    binder_release_work(&thread->todo);
    kfree(thread);
    binder_stats_deleted(BINDER_STAT_THREAD);
    return active_transactions;
}

static unsigned int binder_poll(struct file *filp,

CVE-2019-2215

commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.

binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits.

File affected: kernel-adaptation-sbj-3.4.108.20181002.1/drivers/staging/android/binder.c lines 2629-2644

Fix is available and should look like:

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index f95b559..b2e4f493b 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -2629,16 +2629,28 @@ static int binder_free_thread(struct binder_proc *proc,
                t = t->to_parent;
        } else if (t->from == thread) {
            t->from = NULL;
            t = t->from_parent;
        } else
            BUG();
    }
+       
+   /*
+    * If this thread used poll, make sure we remove the waitqueue  
+    * from any epoll data structures holding it with POLLFREE. 
+    * waitqueue_active() is safe to use here because we're holding 
+    * the inner lock.  
+    */ 
+   if ((thread->looper & BINDER_LOOPER_STATE_NEED_RETURN) &&
+       waitqueue_active(&thread->wait)) {  
+       wake_up_poll(&thread->wait, POLLHUP | POLLFREE);    
+   }
+   
    if (send_reply)
        binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
    binder_release_work(&thread->todo);
    kfree(thread);
    binder_stats_deleted(BINDER_STAT_THREAD);
    return active_transactions;
}

static unsigned int binder_poll(struct file *filp,

CVE-2019-2215

commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.

binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits.

File affected: kernel-adaptation-sbj-3.4.108.20181002.1/drivers/staging/android/binder.c lines 2629-2644

Fix is available and should look like:

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index f95b559..b2e4f493b 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -2629,16 +2629,28 @@ static int binder_free_thread(struct binder_proc *proc,
                t = t->to_parent;
        } else if (t->from == thread) {
            t->from = NULL;
            t = t->from_parent;
        } else
            BUG();
    }
+       
+   /*
+    * If this thread used poll, make sure we remove the waitqueue  
+    * from any epoll data structures holding it with POLLFREE. 
+    * waitqueue_active() is safe to use here because we're holding 
+    * the inner lock.  
+    */ 
+   if ((thread->looper & BINDER_LOOPER_STATE_NEED_RETURN) &&
+       waitqueue_active(&thread->wait)) {  
+       wake_up_poll(&thread->wait, POLLHUP | POLLFREE);    
+   }
+   
    if (send_reply)
        binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
    binder_release_work(&thread->todo);
    kfree(thread);
    binder_stats_deleted(BINDER_STAT_THREAD);
    return active_transactions;
}

static unsigned int binder_poll(struct file *filp,

CVE-2019-2215

commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.

binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits.

File affected: kernel-adaptation-sbj-3.4.108.20181002.1/drivers/staging/android/binder.c lines 2629-2644

Fix is available and should look like:

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index f95b559..b2e4f493b 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -2629,16 +2629,28 @@ static int binder_free_thread(struct binder_proc *proc,
                t = t->to_parent;
        } else if (t->from == thread) {
            t->from = NULL;
            t = t->from_parent;
        } else
            BUG();
    }
+       
+   /*
+    * If this thread used poll, make sure we remove the waitqueue  
+    * from any epoll data structures holding it with POLLFREE. 
+    * waitqueue_active() is safe to use here because we're holding 
+    * the inner lock.  
+    */ 
+   if ((thread->looper & BINDER_LOOPER_STATE_NEED_RETURN) &&
+       waitqueue_active(&thread->wait)) {  
+       wake_up_poll(&thread->wait, POLLHUP | POLLFREE);    
+   }
+   
    if (send_reply)
        binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
    binder_release_work(&thread->todo);
    kfree(thread);
    binder_stats_deleted(BINDER_STAT_THREAD);
    return active_transactions;
}

static unsigned int binder_poll(struct file *filp,