Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 580f1555 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg Committed by Gerrit - the friendly Code Review server
Browse files

ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct 



Prevents leaking pointers between processes

BUG: 30768347
Change-Id: Id898076926f658a1b8b27a3ccb848756b36de4ca
Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>
Git-repo: https://android.googlesource.com/kernel/msm.git


Git-commit: 11032d745836280574827bb1db5e64a94945180e
Signed-off-by: default avatarDennis Cagle <d-cagle@codeaurora.org>
parent 85d7e134

drivers/android/binder.c

+5 −0
Original line number Diff line number Diff line
@@ -1649,7 +1649,9 @@ static void binder_transaction(struct binder_proc *proc, 
				fp->type = BINDER_TYPE_HANDLE;

			else

				fp->type = BINDER_TYPE_WEAK_HANDLE;

			fp->binder = 0;

			fp->handle = ref->desc;

			fp->cookie = 0;

			binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,

				       &thread->todo);
@@ -1696,7 +1698,9 @@ static void binder_transaction(struct binder_proc *proc, 
					return_error = BR_FAILED_REPLY;

					goto err_binder_get_ref_for_node_failed;

				}

				fp->binder = 0;

				fp->handle = new_ref->desc;

				fp->cookie = 0;

				binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);

				trace_binder_transaction_ref_to_ref(t, ref,

								    new_ref);
@@ -1750,6 +1754,7 @@ static void binder_transaction(struct binder_proc *proc, 
			binder_debug(BINDER_DEBUG_TRANSACTION,

				     "        fd %d -> %d\n", fp->handle, target_fd);

			/* TODO: fput? */

			fp->binder = 0;

			fp->handle = target_fd;

		} break;