Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Verified Commit 4ec49481 authored by android-t1's avatar android-t1 Committed by Ahmed Harhash
Browse files

Integrate security patch 2022-10-05-CVE-2022-20421

Change-Id: I93833ab2724047570e529cb3712f8f4aac7d5fc0
parent 65f23e18
Loading
Loading
Loading
Loading
+12 −0
Original line number Diff line number Diff line
@@ -1972,6 +1972,18 @@ static int binder_inc_ref_for_node(struct binder_proc *proc,
	}
	ret = binder_inc_ref_olocked(ref, strong, target_list);
	*rdata = ref->data;
	if (ret && ref == new_ref) {
		/*
		 * Cleanup the failed reference here as the target
		 * could now be dead and have already released its
		 * references by now. Calling on the new reference
		 * with strong=0 and a tmp_refs will not decrement
		 * the node. The new_ref gets kfree'd below.
		 */
		binder_cleanup_ref_olocked(new_ref);
		ref = NULL;
	}

	binder_proc_unlock(proc);
	if (new_ref && ref != new_ref)
		/*