Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code »

Commit 4afb604e2d14d429ac9e1fd84b952602853b2df5

Authored by Arve Hjønnevåg
Committed by Greg Kroah-Hartman
1 parent 0a3ffab93f

ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct 

Prevents leaking pointers between processes

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 5 additions and 0 deletions Side-by-side Diff

drivers/android/binder.c
Diff comments   View file @ 4afb604
... ... @@ -1584,7 +1584,9 @@
1584 1584 fp->type = BINDER_TYPE_HANDLE;
1585 1585 else
1586 1586 fp->type = BINDER_TYPE_WEAK_HANDLE;
  1587 + fp->binder = 0;
1587 1588 fp->handle = ref->desc;
  1589 + fp->cookie = 0;
1588 1590 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
1589 1591 &thread->todo);
1590 1592  
1591 1593  
... ... @@ -1634,7 +1636,9 @@
1634 1636 return_error = BR_FAILED_REPLY;
1635 1637 goto err_binder_get_ref_for_node_failed;
1636 1638 }
  1639 + fp->binder = 0;
1637 1640 fp->handle = new_ref->desc;
  1641 + fp->cookie = 0;
1638 1642 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
1639 1643 trace_binder_transaction_ref_to_ref(t, ref,
1640 1644 new_ref);
... ... @@ -1688,6 +1692,7 @@
1688 1692 binder_debug(BINDER_DEBUG_TRANSACTION,
1689 1693 " fd %d -> %d\n", fp->handle, target_fd);
1690 1694 /* TODO: fput? */
  1695 + fp->binder = 0;
1691 1696 fp->handle = target_fd;
1692 1697 } break;
1693 1698