Todd Kjos 524ad00e80 binder: fix memory leak in error path ...

commit 1909a671db upstream.

syzkallar found a 32-byte memory leak in a rarely executed error
case. The transaction complete work item was not freed if put_user()
failed when writing the BR_TRANSACTION_COMPLETE to the user command
buffer. Fixed by freeing it before put_user() is called.

Reported-by: syzbot+182ce46596c3f2e1eb24@syzkaller.appspotmail.com
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-07-14 08:11:21 +02:00

..

binder_alloc_selftest.c

android: binder: Add global lru shrinker to binder

2017-08-28 16:47:17 +02:00

binder_alloc.c

binder: fix race between munmap() and direct reclaim

2019-06-09 09:17:23 +02:00

binder_alloc.h

binder: fix race that allows malicious free of live buffer

2018-12-05 19:32:11 +01:00

binder_trace.h

android: binder: Show extra_buffers_size in trace

2018-08-02 10:34:12 +02:00

binder.c

binder: fix memory leak in error path

2019-07-14 08:11:21 +02:00

Kconfig

android: binder: Drop dependency on !M68K

2018-07-07 17:44:52 +02:00

Makefile

android: binder: Add allocator selftest

2017-08-28 16:47:17 +02:00