summaryrefslogtreecommitdiff
path: root/drivers/android
diff options
context:
space:
mode:
authorHridya Valsaraju <hridya@google.com>2019-07-15 22:18:04 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-07-24 12:02:28 +0300
commit49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec (patch)
tree34e22e01f39b5099c525ad3857dee3b74dce275c /drivers/android
parenta56587065094fd96eb4c2b5ad65571daad32156d (diff)
downloadlinux-49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec.tar.xz
binder: prevent transactions to context manager from its own process.
Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android')
-rw-r--r--drivers/android/binder.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 5bde08603fbc..dc1c83eafc22 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2988,7 +2988,7 @@ static void binder_transaction(struct binder_proc *proc,
else
return_error = BR_DEAD_REPLY;
mutex_unlock(&context->context_mgr_node_lock);
- if (target_node && target_proc == proc) {
+ if (target_node && target_proc->pid == proc->pid) {
binder_user_error("%d:%d got transaction to context manager from process owning it\n",
proc->pid, thread->pid);
return_error = BR_FAILED_REPLY;