Re: [PATCH v2] binder: fix use-after-free due to fdget() optimization

2018-12-05 Thread Todd Kjos
On Wed, Dec 5, 2018 at 4:40 PM Al Viro wrote: > > On Wed, Dec 05, 2018 at 04:21:55PM -0800, Todd Kjos wrote: > > > > How about grabbing the references to all victims (*before* screwing with > > > ksys_close()), sticking them into a structure with embedded callback_head > > > and using task_work_ad

Re: [PATCH v2] binder: fix use-after-free due to fdget() optimization

2018-12-05 Thread Al Viro
On Wed, Dec 05, 2018 at 04:21:55PM -0800, Todd Kjos wrote: > > How about grabbing the references to all victims (*before* screwing with > > ksys_close()), sticking them into a structure with embedded callback_head > > and using task_work_add() on it, the callback doing those fput()? > > > > The ca

Re: [PATCH v2] binder: fix use-after-free due to fdget() optimization

2018-12-05 Thread Todd Kjos
On Wed, Dec 5, 2018 at 2:00 PM Al Viro wrote: > > On Wed, Dec 05, 2018 at 01:16:01PM -0800, Todd Kjos wrote: > > 44d8047f1d87a ("binder: use standard functions to allocate fds") > > exposed a pre-existing issue in the binder driver. > > > > fdget() is used in ksys_ioctl() as a performance optimiza

Re: [PATCH v2] binder: fix use-after-free due to fdget() optimization

2018-12-05 Thread Al Viro
On Wed, Dec 05, 2018 at 01:16:01PM -0800, Todd Kjos wrote: > 44d8047f1d87a ("binder: use standard functions to allocate fds") > exposed a pre-existing issue in the binder driver. > > fdget() is used in ksys_ioctl() as a performance optimization. > One of the rules associated with fdget() is that k

[PATCH v2] binder: fix use-after-free due to fdget() optimization

2018-12-05 Thread Todd Kjos
44d8047f1d87a ("binder: use standard functions to allocate fds") exposed a pre-existing issue in the binder driver. fdget() is used in ksys_ioctl() as a performance optimization. One of the rules associated with fdget() is that ksys_close() must not be called between the fdget() and the fdput(). T