Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70e0cee7 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg Committed by Amit Pundir
Browse files

ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct 



Prevents leaking pointers between processes

BUG: 30768347
Change-Id: Id898076926f658a1b8b27a3ccb848756b36de4ca
Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>
parent 4581a896

drivers/android/binder.c

+5 −0
Original line number Diff line number Diff line
@@ -1582,7 +1582,9 @@ static void binder_transaction(struct binder_proc *proc, 
				fp->type = BINDER_TYPE_HANDLE;

			else

				fp->type = BINDER_TYPE_WEAK_HANDLE;

			fp->binder = 0;

			fp->handle = ref->desc;

			fp->cookie = 0;

			binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,

				       &thread->todo);
@@ -1630,7 +1632,9 @@ static void binder_transaction(struct binder_proc *proc, 
					return_error = BR_FAILED_REPLY;

					goto err_binder_get_ref_for_node_failed;

				}

				fp->binder = 0;

				fp->handle = new_ref->desc;

				fp->cookie = 0;

				binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);

				trace_binder_transaction_ref_to_ref(t, ref,

								    new_ref);
@@ -1684,6 +1688,7 @@ static void binder_transaction(struct binder_proc *proc, 
			binder_debug(BINDER_DEBUG_TRANSACTION,

				     "        fd %d -> %d\n", fp->handle, target_fd);

			/* TODO: fput? */

			fp->binder = 0;

			fp->handle = target_fd;

		} break;