Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78c26beb authored by Arve Hjønnevåg's avatar Arve Hjønnevåg
Browse files

ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct 



Prevents leaking pointers between processes

BUG: 30768347
Change-Id: Id898076926f658a1b8b27a3ccb848756b36de4ca
Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>
parent b81f4c5f

drivers/android/binder.c

+5 −0
Original line number Diff line number Diff line
@@ -1583,7 +1583,9 @@ static void binder_transaction(struct binder_proc *proc, 
				fp->type = BINDER_TYPE_HANDLE;

			else

				fp->type = BINDER_TYPE_WEAK_HANDLE;

			fp->binder = 0;

			fp->handle = ref->desc;

			fp->cookie = 0;

			binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,

				       &thread->todo);
@@ -1631,7 +1633,9 @@ static void binder_transaction(struct binder_proc *proc, 
					return_error = BR_FAILED_REPLY;

					goto err_binder_get_ref_for_node_failed;

				}

				fp->binder = 0;

				fp->handle = new_ref->desc;

				fp->cookie = 0;

				binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);

				trace_binder_transaction_ref_to_ref(t, ref,

								    new_ref);
@@ -1685,6 +1689,7 @@ static void binder_transaction(struct binder_proc *proc, 
			binder_debug(BINDER_DEBUG_TRANSACTION,

				     "        fd %d -> %d\n", fp->handle, target_fd);

			/* TODO: fput? */

			fp->binder = 0;

			fp->handle = target_fd;

		} break;