Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8910c338 authored by Arve Hjønnevåg's avatar Arve Hjønnevåg Committed by Greg Kroah-Hartman
Browse files

ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct 



commit 4afb604e2d14d429ac9e1fd84b952602853b2df5 upstream.

Prevents leaking pointers between processes

Signed-off-by: default avatarArve Hjønnevåg <arve@android.com>
Signed-off-by: default avatarMartijn Coenen <maco@android.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 14f09e8e

drivers/android/binder.c

+5 −0
Original line number Diff line number Diff line
@@ -1578,7 +1578,9 @@ static void binder_transaction(struct binder_proc *proc, 
				fp->type = BINDER_TYPE_HANDLE;

			else

				fp->type = BINDER_TYPE_WEAK_HANDLE;

			fp->binder = 0;

			fp->handle = ref->desc;

			fp->cookie = 0;

			binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,

				       &thread->todo);
@@ -1628,7 +1630,9 @@ static void binder_transaction(struct binder_proc *proc, 
					return_error = BR_FAILED_REPLY;

					goto err_binder_get_ref_for_node_failed;

				}

				fp->binder = 0;

				fp->handle = new_ref->desc;

				fp->cookie = 0;

				binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);

				trace_binder_transaction_ref_to_ref(t, ref,

								    new_ref);
@@ -1682,6 +1686,7 @@ static void binder_transaction(struct binder_proc *proc, 
			binder_debug(BINDER_DEBUG_TRANSACTION,

				     "        fd %d -> %d\n", fp->handle, target_fd);

			/* TODO: fput? */

			fp->binder = 0;

			fp->handle = target_fd;

		} break;