binder: Fix race between mmap() and binder_alloc_print_pages()
commit5.4-rM2-2.2.x-imx-squashed8eb52a1ee3
upstream. binder_alloc_print_pages() iterates over alloc->pages[0..alloc->buffer_size-1] under alloc->mutex. binder_alloc_mmap_handler() writes alloc->pages and alloc->buffer_size without holding that lock, and even writes them before the last bailout point. Unfortunately we can't take the alloc->mutex in the ->mmap() handler because mmap_sem can be taken while alloc->mutex is held. So instead, we have to locklessly check whether the binder_alloc has been fully initialized with binder_alloc_get_vma(), like in binder_alloc_new_buf_locked(). Fixes:8ef4665aa1
("android: binder: Add page usage in binder stats") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191018205631.248274-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
0bbb506cd5
commit
6e0efd9e9e
|
@ -841,14 +841,20 @@ void binder_alloc_print_pages(struct seq_file *m,
|
||||||
int free = 0;
|
int free = 0;
|
||||||
|
|
||||||
mutex_lock(&alloc->mutex);
|
mutex_lock(&alloc->mutex);
|
||||||
for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
|
/*
|
||||||
page = &alloc->pages[i];
|
* Make sure the binder_alloc is fully initialized, otherwise we might
|
||||||
if (!page->page_ptr)
|
* read inconsistent state.
|
||||||
free++;
|
*/
|
||||||
else if (list_empty(&page->lru))
|
if (binder_alloc_get_vma(alloc) != NULL) {
|
||||||
active++;
|
for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
|
||||||
else
|
page = &alloc->pages[i];
|
||||||
lru++;
|
if (!page->page_ptr)
|
||||||
|
free++;
|
||||||
|
else if (list_empty(&page->lru))
|
||||||
|
active++;
|
||||||
|
else
|
||||||
|
lru++;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
mutex_unlock(&alloc->mutex);
|
mutex_unlock(&alloc->mutex);
|
||||||
seq_printf(m, " pages: %d:%d:%d\n", active, lru, free);
|
seq_printf(m, " pages: %d:%d:%d\n", active, lru, free);
|
||||||
|
|
Loading…
Reference in New Issue