Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cf8bee4e authored by shaohanlin's avatar shaohanlin
Browse files

Merge branch mp-release-spl-202010 into mp-release 

* origin/8901-fp3-q-mp-release-spl-202010:
  binder: fix UAF when releasing todo list

Change-Id: I97e53fca3b9a9a691568952900ec9444b1068bc9
parents e34be057 0cbcd22d

drivers/android/binder.c

+10 −25
Original line number Diff line number Diff line
@@ -281,7 +281,7 @@ struct binder_device { 
struct binder_work {

	struct list_head entry;



	enum {

	enum binder_work_type {

		BINDER_WORK_TRANSACTION = 1,

		BINDER_WORK_TRANSACTION_COMPLETE,

		BINDER_WORK_RETURN_ERROR,
@@ -938,27 +938,6 @@ static struct binder_work *binder_dequeue_work_head_ilocked( 
	return w;

}



/**

 * binder_dequeue_work_head() - Dequeues the item at head of list

 * @proc:         binder_proc associated with list

 * @list:         list to dequeue head

 *

 * Removes the head of the list if there are items on the list

 *

 * Return: pointer dequeued binder_work, NULL if list was empty

 */

static struct binder_work *binder_dequeue_work_head(

					struct binder_proc *proc,

					struct list_head *list)

{

	struct binder_work *w;



	binder_inner_proc_lock(proc);

	w = binder_dequeue_work_head_ilocked(list);

	binder_inner_proc_unlock(proc);

	return w;

}



static void

binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);

static void binder_free_thread(struct binder_thread *thread);
@@ -4584,13 +4563,17 @@ static void binder_release_work(struct binder_proc *proc, 
				struct list_head *list)

{

	struct binder_work *w;

	enum binder_work_type wtype;



	while (1) {

		w = binder_dequeue_work_head(proc, list);

		binder_inner_proc_lock(proc);

		w = binder_dequeue_work_head_ilocked(list);

		wtype = w ? w->type : 0;

		binder_inner_proc_unlock(proc);

		if (!w)

			return;



		switch (w->type) {

		switch (wtype) {

		case BINDER_WORK_TRANSACTION: {

			struct binder_transaction *t;
@@ -4624,9 +4607,11 @@ static void binder_release_work(struct binder_proc *proc, 
			kfree(death);

			binder_stats_deleted(BINDER_STAT_DEATH);

		} break;

		case BINDER_WORK_NODE:

			break;

		default:

			pr_err("unexpected work type, %d, not freed\n",

			       w->type);

			       wtype);

			break;

		}

	}