diff options
author | Arve Hjønnevåg <arve@android.com> | 2016-10-24 16:20:30 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-04-18 08:55:45 +0300 |
commit | ddfe528c0ef64f086c1018cee6529fc4e577019c (patch) | |
tree | 2bb7fcb7f542f7c433053a4d77a01bd567e6d2a3 | |
parent | 663673422e18b5df59b8632f05956ffb11d41aa9 (diff) | |
download | linux-ddfe528c0ef64f086c1018cee6529fc4e577019c.tar.xz |
ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct
commit 4afb604e2d14d429ac9e1fd84b952602853b2df5 upstream.
Prevents leaking pointers between processes
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | drivers/staging/android/binder.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 7d6050cfa914..2186380a6f51 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -1563,7 +1563,9 @@ static void binder_transaction(struct binder_proc *proc, fp->type = BINDER_TYPE_HANDLE; else fp->type = BINDER_TYPE_WEAK_HANDLE; + fp->binder = 0; fp->handle = ref->desc; + fp->cookie = 0; binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, &thread->todo); @@ -1608,7 +1610,9 @@ static void binder_transaction(struct binder_proc *proc, return_error = BR_FAILED_REPLY; goto err_binder_get_ref_for_node_failed; } + fp->binder = 0; fp->handle = new_ref->desc; + fp->cookie = 0; binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); trace_binder_transaction_ref_to_ref(t, ref, new_ref); @@ -1655,6 +1659,7 @@ static void binder_transaction(struct binder_proc *proc, binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n", fp->handle, target_fd); /* TODO: fput? */ + fp->binder = 0; fp->handle = target_fd; } break; |