patch "android: binder: fix dangling pointer comparison" added to char-misc-linus

This is a note to let you know that I've just added the patch titled

android: binder: fix dangling pointer comparison

to my char-misc git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
in the char-misc-linus branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.

If you have any questions about this process, please let me know.

From: Jann Horn <[email protected]>
Date: Thu, 16 Jun 2016 00:45:33 +0200
Subject: android: binder: fix dangling pointer comparison

If /dev/binder is opened and the opener process then e.g. calls execve, proc->vma_vm_mm will still point to the location of the now-freed mm_struct. If the process then calls ioctl(binder_fd, ...), the dangling proc->vma_vm_mm pointer will be compared to current->mm.

Let the binder take a reference to the mm_struct to avoid this.

v2: use the right refcounter

---
 drivers/android/binder.c | 2 ++
 1 file changed, 2 insertions(+)

index 16288e777ec3..09fdb425e2f5 100644
@@ -2962,6 +2962,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
 		return -ENOMEM;
 	get_task_struct(current);
 	proc->tsk = current;
+	atomic_inc(&current->mm->mm_count);
 	proc->vma_vm_mm = current->mm;
 	INIT_LIST_HEAD(&proc->todo);
 	init_waitqueue_head(&proc->wait);

@@ -3167,6 +3168,7 @@ static void binder_deferred_release(struct binder_proc *proc)
 		vfree(proc->buffer);
 	}
 
+	mmdrop(proc->vma_vm_mm);
 	put_task_struct(proc->tsk);
 
 	binder_debug(BINDER_DEBUG_OPEN_CLOSE,

2.9.3