UPSTREAM: ANDROID: binder: remove waitqueue when thread exits.
binder_poll() passes the thread->wait waitqueue that
can be slept on for work. When a thread that uses
epoll explicitly exits using BINDER_THREAD_EXIT,
the waitqueue is freed, but it is never removed
from the corresponding epoll data structure. When
the process subsequently exits, the epoll cleanup
code tries to access the waitlist, which results in
Prevent this by using POLLFREE when the thread exits.
(cherry picked from commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f)
Signed-off-by: Martijn Coenen <email@example.com>
Reported-by: syzbot <firstname.lastname@example.org>
Cc: stable <email@example.com> # 4.14
Signed-off-by: Greg Kroah-Hartman <firstname.lastname@example.org>
1 file changed