lkml.org 
[lkml]   [2019]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 185/215] binder: prevent transactions to context manager from its own process.
    Date
    From: Hridya Valsaraju <hridya@google.com>

    commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec upstream.

    Currently, a transaction to context manager from its own process
    is prevented by checking if its binder_proc struct is the same as
    that of the sender. However, this would not catch cases where the
    process opens the binder device again and uses the new fd to send
    a transaction to the context manager.

    Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com
    Signed-off-by: Hridya Valsaraju <hridya@google.com>
    Acked-by: Todd Kjos <tkjos@google.com>
    Cc: stable <stable@vger.kernel.org>
    Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/android/binder.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/android/binder.c
    +++ b/drivers/android/binder.c
    @@ -2988,7 +2988,7 @@ static void binder_transaction(struct bi
    else
    return_error = BR_DEAD_REPLY;
    mutex_unlock(&context->context_mgr_node_lock);
    - if (target_node && target_proc == proc) {
    + if (target_node && target_proc->pid == proc->pid) {
    binder_user_error("%d:%d got transaction to context manager from process owning it\n",
    proc->pid, thread->pid);
    return_error = BR_FAILED_REPLY;

    \
     
     \ /
      Last update: 2019-07-29 22:10    [W:4.019 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site