| commit | a370003cc301d4361bae20c9ef615f89bf8d1e8a | [log] [tgz] |
|---|---|---|
| author | Todd Kjos <tkjos@android.com> | Wed Jun 12 13:29:27 2019 -0700 |
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | Thu Jun 13 10:35:55 2019 +0200 |
| tree | d96c2242a45c688ac249891b7a4d39851a2b2e19 | |
| parent | b7108486d2d60357dec274276e2f69128f29dcdc [diff] |
binder: fix possible UAF when freeing buffer There is a race between the binder driver cleaning up a completed transaction via binder_free_transaction() and a user calling binder_ioctl(BC_FREE_BUFFER) to release a buffer. It doesn't matter which is first but they need to be protected against running concurrently which can result in a UAF. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>