Martijn Coenen f5cb779ba1 ANDROID: binder: remove waitqueue when thread exits. ... binder_poll() passes the thread->wait waitqueue that can be slept on for work. When a thread that uses epoll explicitly exits using BINDER_THREAD_EXIT, the waitqueue is freed, but it is never removed from the corresponding epoll data structure. When the process subsequently exits, the epoll cleanup code tries to access the waitlist, which results in a use-after-free. Prevent this by using POLLFREE when the thread exits. Signed-off-by: Martijn Coenen <maco@android.com> Reported-by: syzbot <syzkaller@googlegroups.com> Cc: stable <stable@vger.kernel.org> # 4.14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-01-09 17:54:01 +01:00
..
binder_alloc_selftest.c	android: binder: Add global lru shrinker to binder	2017-08-28 16:47:17 +02:00
binder_alloc.c	ANDROID: binder: make binder_alloc_new_buf_locked static and indent its arguments	2017-12-19 10:12:57 +01:00
binder_alloc.h	android: binder: Check for errors in binder_alloc_shrinker_init().	2017-12-18 15:59:17 +01:00
binder_trace.h	android: binder: Add shrinker tracepoints	2017-08-28 16:47:17 +02:00
binder.c	ANDROID: binder: remove waitqueue when thread exits.	2018-01-09 17:54:01 +01:00
Kconfig	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
Makefile	android: binder: Add allocator selftest	2017-08-28 16:47:17 +02:00