Re: [PATCH v2] binder: fix use-after-free due to ksys_close() during fdget()

2018-12-14 Thread Al Viro
On Fri, Dec 14, 2018 at 12:38:15PM -0800, Todd Kjos wrote: > 44d8047f1d8 ("binder: use standard functions to allocate fds") > exposed a pre-existing issue in the binder driver. > > fdget() is used in ksys_ioctl() as a performance optimization. > One of the rules associated with fdget() is that ksy

[PATCH v2] binder: fix use-after-free due to ksys_close() during fdget()

2018-12-14 Thread Todd Kjos
44d8047f1d8 ("binder: use standard functions to allocate fds") exposed a pre-existing issue in the binder driver. fdget() is used in ksys_ioctl() as a performance optimization. One of the rules associated with fdget() is that ksys_close() must not be called between the fdget() and the fdput(). The