Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
kernel-fxtec-pro1x/drivers
History
Christian Brauner 45e4d11fa6 binderfs: use refcount for binder control devices too 
Binderfs binder-control devices are cleaned up via binderfs_evict_inode
too() which will use refcount_dec_and_test(). However, we missed to set
the refcount for binderfs binder-control devices and so we underflowed
when the binderfs instance got unmounted. Pretty obvious oversight and
should have been part of the more general UAF fix. The good news is that
having test cases (suprisingly) helps.

Technically, we could detect that we're about to cleanup the
binder-control dentry in binderfs_evict_inode() and then simply clean it
up. But that makes the assumption that the binder driver itself will
never make use of a binderfs binder-control device after the binderfs
instance it belongs to has been unmounted and the superblock for it been
destroyed. While it is unlikely to ever come to this let's be on the
safe side. Performance-wise this also really doesn't matter since the
binder-control device is only every really when creating the binderfs
filesystem or creating additional binder devices. Both operations are
pretty rare.

Fixes: f0fe2c0f050d ("binder: prevent UAF for binderfs devices II")
Link: https://lore.kernel.org/r/CA+G9fYusdfg7PMfC9Xce-xLT7NiyKSbgojpK35GOm=Pf9jXXrA@mail.gmail.com
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20200311105309.1742827-1-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-01-16 14:59:34 +02:00
..
accessibility
acpi This is the 4.19.156 stable release 2020-11-10 13:23:09 +01:00
amba
android binderfs: use refcount for binder control devices too 2023-01-16 14:59:34 +02:00
ata ata: sata_nv: Fix retrieving of active qcs 2020-11-05 11:08:38 +01:00
atm atm: eni: fix the missed pci_disable_device() for eni_init_one() 2020-10-01 13:14:51 +02:00
auxdisplay
base Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
bcma
block Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
bluetooth Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
bus Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
cdrom
char Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
clk Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
clocksource Merge android-4.19-stable.149 (9ce79d9) into msm-4.19 2020-10-21 09:25:49 +05:30
connector
cpufreq Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
cpuidle Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
crypto Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
dax
dca
devfreq Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
dio
dma Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
dma-buf Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
edac Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
eisa
energy_model
esoc
extcon extcon: Initialize blocking notifier while registering 2021-04-09 17:59:37 +05:30
firewire
firmware Merge android-4.19-stable.149 (9ce79d9) into msm-4.19 2020-10-21 09:25:49 +05:30
fmc
fpga fpga: dfl: fix bug in port reset handshake 2020-07-29 10:16:48 +02:00
fsi
gnss
gpio Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
gpu Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
hid HID: add HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE for Gamevice devices 2021-08-09 17:01:51 +05:30
hsi
hv Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload 2020-09-23 12:10:59 +02:00
hwmon This is the 4.19.153 stable release 2020-10-29 11:36:20 +01:00
hwspinlock
hwtracing Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
i2c Import F(x)tec Pro1-X BSP kernel changes as of 2022-06-01 2022-06-13 23:51:22 +03:00
i3c Merge "i3c: i3c-master-qcom-geni: Force the xfer mode as DMA mode" 2021-04-24 14:42:41 -07:00
ide
idle
iio Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
infiniband This is the 4.19.155 stable release 2020-11-05 14:02:27 +01:00
input drivers: aw9523: match the Pro1-X us layout, including support for function keys 2022-08-03 12:51:53 +03:00
iommu Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
ipack
irqchip Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
isdn
lastkmsg drivers: Import lastkmsg drivers from Xiaomi 2021-08-21 16:10:46 +02:00
leds Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
lightnvm
macintosh
mailbox Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
mcb
md Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
media Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
memory memory: emif: Remove bogus debugfs error handling 2020-11-05 11:08:45 +01:00
memstick
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-11-05 11:08:47 +01:00
mfd Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
misc Import F(x)tec Pro1-X BSP kernel changes as of 2022-06-01 2022-06-13 23:51:22 +03:00
mmc Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
mtd ubi: check kthread_should_stop() after the setting of task state 2020-11-05 11:08:52 +01:00
mux
net Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
nfc Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
ntb NTB: hw: amd: fix an issue about leak system resources 2020-10-30 10:38:25 +01:00
nubus
nvdimm
nvme nvme-rdma: fix crash when connect rejected 2020-11-05 11:08:45 +01:00
nvmem Merge android-4.19-stable.136 (204dd19) into msm-4.19 2020-10-14 20:04:29 +05:30
of Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
opp
oprofile
parisc parisc: mask out enable and reserved bits from sba imask 2020-08-19 08:15:07 +02:00
parport
pci Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
pcmcia
perf Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
phy drivers: phy: ufs: Remove the condition check to calibrate UFS Phy 2020-11-18 11:07:27 -08:00
pinctrl kernel: Merge LA.UM.9.15.r1-05300-KAMORTA.0 2022-06-11 03:14:24 +03:00
platform kernel: Merge LA.UM.9.15.r1-05300-KAMORTA.0 2022-06-11 03:14:24 +03:00
pnp
power HACK: Set “Mains” type for BMS and Main 2023-01-16 12:13:38 +02:00
powercap powercap: restrict energy meter to root access 2020-11-10 21:11:27 +01:00
pps
ps3
ptp
pwm Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2020-10-30 10:38:21 +01:00
ras
regulator Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
remoteproc remoteproc: qcom: q6v5: Update running state before requesting stop 2020-08-21 11:05:34 +02:00
reset
rpmsg Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
rtc Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
s390 s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl 2020-10-01 13:14:54 +02:00
sbus
scsi Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
sensors
sfi
sh
siox
slimbus Merge android-4.19-stable.157 (8ee67bc) into msm-4.19 2020-12-18 18:35:06 +05:30
sn
soc kernel: Merge LA.UM.9.15.r1-05300-KAMORTA.0 2022-06-11 03:14:24 +03:00
soundwire
spi spi: spi-geni-qcom: Set IOEB for MHI on SPI RX only case 2021-04-15 19:32:24 +05:30
spmi Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
ssb
staging kernel: Merge LA.UM.9.15.r1-02200-KAMORTA.0 2021-08-26 06:45:49 +02:00
switch drivers: switch: Import xiaomi changes 2021-08-21 16:10:46 +02:00
target scsi: target: tcmu: Fix warning: 'page' may be used uninitialized 2020-10-29 09:55:14 +01:00
tc
tee
thermal Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
thunderbolt
tty Import F(x)tec Pro1-X BSP kernel changes as of 2022-06-01 2022-06-13 23:51:22 +03:00
uio Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
usb Import Pro1-X kernel source code 2022-03-20 00:13:44 +01:00
uwb
vfio This is the 4.19.154 stable release 2020-10-30 11:43:26 +01:00
vhost This is the 4.19.155 stable release 2020-11-05 14:02:27 +01:00
video kernel: Merge LA.UM.9.15.r1-05300-KAMORTA.0 2022-06-11 03:14:24 +03:00
virt drivers/virt/fsl_hypervisor: Fix error handling path 2020-10-29 09:55:09 +01:00
virtio This is the 4.19.142 stable release 2020-08-26 11:07:03 +02:00
visorbus
vlynq
vme
vservices
w1 w1: mxc_w1: Fix timeout resolution problem leading to bus error 2020-11-05 11:08:47 +01:00
watchdog drivers: watchdog: rdc321x_wdt: Fix race condition bugs 2020-11-05 11:08:44 +01:00
xen xen/events: block rogue events for some time 2020-11-05 11:08:37 +01:00
zorro
Kconfig drivers: Import lastkmsg drivers from Xiaomi 2021-08-21 16:10:46 +02:00
Makefile drivers: Import lastkmsg drivers from Xiaomi 2021-08-21 16:10:46 +02:00