Re: [PATCH] binder: fix race that allows malicious free of live buffer

2018-11-09 Thread Todd Kjos
On Fri, Nov 9, 2018 at 4:32 AM Greg KH wrote: > > On Tue, Nov 06, 2018 at 03:55:32PM -0800, Todd Kjos wrote: > > Malicious code can attempt to free buffers using the > > BC_FREE_BUFFER ioctl to binder. There are protections > > against a user freeing a buffer while in use by the > > kernel,

Re: [PATCH] binder: fix race that allows malicious free of live buffer

2018-11-09 Thread Todd Kjos
On Fri, Nov 9, 2018 at 4:32 AM Greg KH wrote: > > On Tue, Nov 06, 2018 at 03:55:32PM -0800, Todd Kjos wrote: > > Malicious code can attempt to free buffers using the > > BC_FREE_BUFFER ioctl to binder. There are protections > > against a user freeing a buffer while in use by the > > kernel,

Re: [PATCH] binder: fix race that allows malicious free of live buffer

2018-11-09 Thread Greg KH
On Tue, Nov 06, 2018 at 03:55:32PM -0800, Todd Kjos wrote: > Malicious code can attempt to free buffers using the > BC_FREE_BUFFER ioctl to binder. There are protections > against a user freeing a buffer while in use by the > kernel, however there was a window where BC_FREE_BUFFER > could be used

Re: [PATCH] binder: fix race that allows malicious free of live buffer

2018-11-09 Thread Greg KH
On Tue, Nov 06, 2018 at 03:55:32PM -0800, Todd Kjos wrote: > Malicious code can attempt to free buffers using the > BC_FREE_BUFFER ioctl to binder. There are protections > against a user freeing a buffer while in use by the > kernel, however there was a window where BC_FREE_BUFFER > could be used

[PATCH] binder: fix race that allows malicious free of live buffer

2018-11-06 Thread Todd Kjos
Malicious code can attempt to free buffers using the BC_FREE_BUFFER ioctl to binder. There are protections against a user freeing a buffer while in use by the kernel, however there was a window where BC_FREE_BUFFER could be used to free a recently allocated buffer that was not completely

[PATCH] binder: fix race that allows malicious free of live buffer

2018-11-06 Thread Todd Kjos
Malicious code can attempt to free buffers using the BC_FREE_BUFFER ioctl to binder. There are protections against a user freeing a buffer while in use by the kernel, however there was a window where BC_FREE_BUFFER could be used to free a recently allocated buffer that was not completely