lkml.org 
[lkml]   [2016]   [Nov]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 015/127] ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct
    Date
    From: Arve Hjønnevåg <arve@android.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 4afb604e2d14d429ac9e1fd84b952602853b2df5 upstream.

    Prevents leaking pointers between processes

    Signed-off-by: Arve Hjønnevåg <arve@android.com>
    Signed-off-by: Martijn Coenen <maco@android.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    drivers/staging/android/binder.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
    index 8a436dae9b77..a29a383d160d 100644
    --- a/drivers/staging/android/binder.c
    +++ b/drivers/staging/android/binder.c
    @@ -1541,7 +1541,9 @@ static void binder_transaction(struct binder_proc *proc,
    fp->type = BINDER_TYPE_HANDLE;
    else
    fp->type = BINDER_TYPE_WEAK_HANDLE;
    + fp->binder = NULL;
    fp->handle = ref->desc;
    + fp->cookie = NULL;
    binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
    &thread->todo);

    @@ -1584,7 +1586,9 @@ static void binder_transaction(struct binder_proc *proc,
    return_error = BR_FAILED_REPLY;
    goto err_binder_get_ref_for_node_failed;
    }
    + fp->binder = NULL;
    fp->handle = new_ref->desc;
    + fp->cookie = NULL;
    binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
    trace_binder_transaction_ref_to_ref(t, ref,
    new_ref);
    @@ -1631,6 +1635,7 @@ static void binder_transaction(struct binder_proc *proc,
    binder_debug(BINDER_DEBUG_TRANSACTION,
    " fd %d -> %d\n", fp->handle, target_fd);
    /* TODO: fput? */
    + fp->binder = NULL;
    fp->handle = target_fd;
    } break;

    --
    2.10.2
    \
     
     \ /
      Last update: 2016-11-25 10:09    [W:3.291 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site