Merge "ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct" (eca64e3a) · Commits · e / devices / android_kernel_xiaomi_markw

drivers/staging/android/binder.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -1572,7 +1572,9 @@ static void binder_transaction(struct binder_proc *proc,
		fp->type = BINDER_TYPE_HANDLE;
		else
		fp->type = BINDER_TYPE_WEAK_HANDLE;
		fp->binder = 0;
		fp->handle = ref->desc;
		fp->cookie = 0;
		binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
		&thread->todo);

		@@ -1618,7 +1620,9 @@ static void binder_transaction(struct binder_proc *proc,
		return_error = BR_FAILED_REPLY;
		goto err_binder_get_ref_for_node_failed;
		}
		fp->binder = 0;
		fp->handle = new_ref->desc;
		fp->cookie = 0;
		binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
		trace_binder_transaction_ref_to_ref(t, ref,
		new_ref);
		@@ -1670,6 +1674,7 @@ static void binder_transaction(struct binder_proc *proc,
		binder_debug(BINDER_DEBUG_TRANSACTION,
		" fd %d -> %d\n", fp->handle, target_fd);
		/* TODO: fput? */
		fp->binder = 0;
		fp->handle = target_fd;
		} break;