Eric Biggers 83c76f2c50 binder: check for binder_thread allocation failure in binder_poll() ...

commit f88982679f54f75daa5b8eff3da72508f1e7422f upstream.

If the kzalloc() in binder_get_thread() fails, binder_poll()
dereferences the resulting NULL pointer.

Fix it by returning POLLERR if the memory allocation failed.

This bug was found by syzkaller using fault injection.

Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-02-25 11:03:38 +01:00

..

binder_trace.h

…

binder.c

binder: check for binder_thread allocation failure in binder_poll()

2018-02-25 11:03:38 +01:00

Kconfig

…

Makefile

…