Todd Kjos 22068d49d0 binder: fix possible UAF when freeing buffer ...

commit a370003cc3 upstream.

There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.

Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-08-04 09:30:53 +02:00

..

binder_alloc_selftest.c

android: binder: Add global lru shrinker to binder

2017-08-28 16:47:17 +02:00

binder_alloc.c

binder: fix race between munmap() and direct reclaim

2019-06-09 09:17:23 +02:00

binder_alloc.h

binder: fix race that allows malicious free of live buffer

2018-12-05 19:32:11 +01:00

binder_trace.h

android: binder: Show extra_buffers_size in trace

2018-08-02 10:34:12 +02:00

binder.c

binder: fix possible UAF when freeing buffer

2019-08-04 09:30:53 +02:00

Kconfig

android: binder: Drop dependency on !M68K

2018-07-07 17:44:52 +02:00

Makefile

android: binder: Add allocator selftest

2017-08-28 16:47:17 +02:00