Merge "binder: fix null deref of proc->context" (5086c11d) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/android/binder.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -4664,8 +4664,15 @@ static struct binder_thread binder_get_thread(struct binder_proc proc)

		static void binder_free_proc(struct binder_proc *proc)
		{
		struct binder_device *device;

		BUG_ON(!list_empty(&proc->todo));
		BUG_ON(!list_empty(&proc->delivered_death));
		device = container_of(proc->context, struct binder_device, context);
		if (refcount_dec_and_test(&device->ref)) {
		kfree(proc->context->name);
		kfree(device);
		}
		binder_alloc_deferred_release(&proc->alloc);
		put_task_struct(proc->tsk);
		binder_stats_deleted(BINDER_STAT_PROC);
		@@ -5393,7 +5400,6 @@ static int binder_node_release(struct binder_node *node, int refs)
		static void binder_deferred_release(struct binder_proc *proc)
		{
		struct binder_context *context = proc->context;
		struct binder_device *device;
		struct rb_node *n;
		int threads, nodes, incoming_refs, outgoing_refs, active_transactions;

		@@ -5412,12 +5418,6 @@ static void binder_deferred_release(struct binder_proc *proc)
		context->binder_context_mgr_node = NULL;
		}
		mutex_unlock(&context->context_mgr_node_lock);
		device = container_of(proc->context, struct binder_device, context);
		if (refcount_dec_and_test(&device->ref)) {
		kfree(context->name);
		kfree(device);
		}
		proc->context = NULL;
		binder_inner_proc_lock(proc);
		/*
		* Make sure proc stays alive after we