Re: [PATCH] binder: fix use-after-free due to fdget() optimization

2018-12-05 Thread Greg KH
On Mon, Dec 03, 2018 at 12:24:57PM -0800, Todd Kjos wrote: > 44d8047f1d87a ("binder: use standard functions to allocate fds") > exposed a pre-existing issue in the binder driver. > > fdget() is used in ksys_ioctl() as a performance optimization. > One of the rules associated with fdget() is that

[PATCH] binder: fix use-after-free due to fdget() optimization

2018-12-03 Thread Todd Kjos
44d8047f1d87a ("binder: use standard functions to allocate fds") exposed a pre-existing issue in the binder driver. fdget() is used in ksys_ioctl() as a performance optimization. One of the rules associated with fdget() is that ksys_close() must not be called between the fdget() and the fdput().