tree 8bbe76bf51d9ad2fa559c9a97715376b3f96a8ac
parent a735b4a77a56b6d39244030c78092a59c8170a8e
author Todd Kjos <tkjos@google.com> 1510356627 -0800
committer Victor Xu <chaoxu@mobvoi.com> 1539074213 +0800

FROMLIST: binder: fix proc->files use-after-free

(from https://patchwork.kernel.org/patch/10058587/)

proc->files cleanup is initiated by binder_vma_close. Therefore
a reference on the binder_proc is not enough to prevent the
files_struct from being released while the binder_proc still has
a reference. This can lead to an attempt to dereference the
stale pointer obtained from proc->files prior to proc->files
cleanup. This has been seen once in task_get_unused_fd_flags()
when __alloc_fd() is called with a stale "files".

The fix is to always use get_files_struct() to obtain struct_files
so that the refcount on the files_struct is used to prevent
a premature free. proc->files is removed since we get it every
time.

Bug: 69164715
Change-Id: I6431027d3d569e76913935c21885201505627982
Signed-off-by: Todd Kjos <tkjos@google.com>