Todd Kjos a370003cc3 binder: fix possible UAF when freeing buffer ...

There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.

Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-06-13 10:35:55 +02:00

..

binder_alloc_selftest.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

2019-06-05 17:36:37 +02:00

binder_alloc.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

2019-06-05 17:36:37 +02:00

binder_alloc.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

2019-06-05 17:36:37 +02:00

binder_internal.h

binderfs: remove separate device_initcall()

2019-02-01 15:50:26 +01:00

binder_trace.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

2019-06-05 17:36:37 +02:00

binder.c

binder: fix possible UAF when freeing buffer

2019-06-13 10:35:55 +02:00

binderfs.c

binderfs: remove separate device_initcall()

2019-02-01 15:50:26 +01:00

Kconfig

binder: add functions to copy to/from binder buffers

2019-02-12 10:43:57 +01:00

Makefile

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00