ANDROID: binder: synchronize_rcu() when using POLLFREE.
commit 5eeb2ca0 upstream. To prevent races with ep_remove_waitqueue() removing the waitqueue at the same time. Reported-by: <syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com> Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable <stable@vger.kernel.org> # 4.14+ Signed-off-by: Mattias Nissler <mnissler@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
80eb98a4
Please register or sign in to comment