Commit e10d4a94 authored Jul 15, 2019 by Hridya Valsaraju Committed by Bernhard Thoben Jul 31, 2021

binder: prevent transactions to context manager from its own process.



Currently, a transaction to context manager from its own process
is prevented by checking if its binder_proc struct is the same as
that of the sender. However, this would not catch cases where the
process opens the binder device again and uses the new fd to send
a transaction to the context manager.

Reported-by:  <syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com>
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec)

parent dbc4190a

drivers/android/binder.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -3033,7 +3033,7 @@ static void binder_transaction(struct binder_proc *proc,
		else
		return_error = BR_DEAD_REPLY;
		mutex_unlock(&context->context_mgr_node_lock);
		if (target_node && target_proc == proc) {
		if (target_node && target_proc->pid == proc->pid) {
		binder_user_error("%d:%d got transaction to context manager from process owning it\n",
		proc->pid, thread->pid);
		return_error = BR_FAILED_REPLY;