summaryrefslogtreecommitdiff
path: root/Makefile
diff options
context:
space:
mode:
authorTodd Kjos <tkjos@android.com>2017-09-29 15:39:49 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-10-04 11:25:10 +0200
commit512cf465ee01eb23936a9e6ed0b6414eccb00853 (patch)
treeacd6475a037326bd58015094502d79b42165c436 /Makefile
parent192b2d78722ffea188e5ec6ae5d55010dce05a4b (diff)
binder: fix use-after-free in binder_transaction()
User-space normally keeps the node alive when creating a transaction since it has a reference to the target. The local strong ref keeps it alive if the sending process dies before the target process processes the transaction. If the source process is malicious or has a reference counting bug, this can fail. In this case, when we attempt to decrement the node in the failure path, the node has already been freed. This is fixed by taking a tmpref on the node while constructing the transaction. To avoid re-acquiring the node lock and inner proc lock to increment the proc's tmpref, a helper is used that does the ref increments on both the node and proc. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'Makefile')
0 files changed, 0 insertions, 0 deletions