staging: binder: Fix memory corruption via page aliasing
authorChristopher Lais <chris+android@zenthought.org>
Sat, 1 May 2010 20:51:48 +0000 (15:51 -0500)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 30 Nov 2011 11:51:37 +0000 (20:51 +0900)
commit58526090ece3582516e62779739a7d665a74708c
tree3bef2705ebe51c3d0e4f0b8dfee3379b9074a57c
parent4755b72e261478b48337e0e54c8448cbea32c5c8
staging: binder: Fix memory corruption via page aliasing

binder_deferred_release was not unmapping the page from the buffer
before freeing it, causing memory corruption.  This only happened
when page(s) had not been freed by binder_update_page_range, which
properly unmaps the pages.

This only happens on architectures with VIPT aliasing.

To reproduce, create a program which opens, mmaps, munmaps, then closes
the binder very quickly.  This should leave a page allocated when the
binder is released.  When binder_deferrred_release is called on the
close, the page will remain mapped to the address in the linear
proc->buffer.  Later, we may map the same physical page to a different
virtual address that has different coloring, and this may cause
aliasing to occur.

PAGE_POISONING will greatly increase your chances of noticing any
problems.

Signed-off-by: Christopher Lais <chris+android@zenthought.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
drivers/staging/android/binder.c