tag 21d7b3fa720741b8e5a33a358e01127bdfc108df
tagger Todd Kjos <tkjos@google.com> Mon Feb 03 16:17:45 2020 -0800
object a12d1ce91b8cccb239991af90daf46311b7ba975

https://source.android.com/security/bulletin/2020-02-01
CVE-2020-0030
CVE-2019-11599

commit a12d1ce91b8cccb239991af90daf46311b7ba975
author Martijn Coenen <maco@android.com> Fri Feb 16 09:47:15 2018 +0100
committer Todd Kjos <tkjos@google.com> Wed Jan 29 15:04:05 2020 -0800
tree 762f89b7675a42da8a6e793cf6934ac69a236652
parent a493de2ff342b94623e9241ba0b7926be9c09693

ANDROID: binder: synchronize_rcu() when using POLLFREE.

commit 5eeb2ca02a2f6084fc57ae5c244a38baab07033a upstream.

To prevent races with ep_remove_waitqueue() removing the
waitqueue at the same time.

Change-Id: I6c7528260aaca7d1015eefad1802c6104aa371e3
Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org> # 4.14+
Signed-off-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>