tag afc6305b14f28f29976ae2e7d42f12226cbd53f7
tagger Todd Kjos <tkjos@google.com> Mon Feb 03 16:17:19 2020 -0800
object 4f7792a0ca36fd500b31ed2d2fd9d87e74cd814c

https://source.android.com/security/bulletin/2020-02-01
CVE-2020-0030
CVE-2019-11599

commit 4f7792a0ca36fd500b31ed2d2fd9d87e74cd814c
author Martijn Coenen <maco@android.com> Fri Feb 16 09:47:15 2018 +0100
committer Todd Kjos <tkjos@google.com> Wed Jan 29 15:06:32 2020 -0800
tree 7efd61304bfe486059348593a77aceff5f4830bf
parent d01296343a2ee185fa918fcc6335fc283bf5f122

UPSTREAM: ANDROID: binder: synchronize_rcu() when using POLLFREE.

To prevent races with ep_remove_waitqueue() removing the
waitqueue at the same time.

Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org> # 4.14+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 5eeb2ca02a2f6084fc57ae5c244a38baab07033a)

Change-Id: Ia0089448079c78d0ab0b57303faf838e9e5ee797