From 58526090ece3582516e62779739a7d665a74708c Mon Sep 17 00:00:00 2001 From: Christopher Lais Date: Sat, 1 May 2010 15:51:48 -0500 Subject: [PATCH] staging: binder: Fix memory corruption via page aliasing binder_deferred_release was not unmapping the page from the buffer before freeing it, causing memory corruption. This only happened when page(s) had not been freed by binder_update_page_range, which properly unmaps the pages. This only happens on architectures with VIPT aliasing. To reproduce, create a program which opens, mmaps, munmaps, then closes the binder very quickly. This should leave a page allocated when the binder is released. When binder_deferrred_release is called on the close, the page will remain mapped to the address in the linear proc->buffer. Later, we may map the same physical page to a different virtual address that has different coloring, and this may cause aliasing to occur. PAGE_POISONING will greatly increase your chances of noticing any problems. Signed-off-by: Christopher Lais Signed-off-by: Greg Kroah-Hartman --- Reading git-format-patch failed