]> asedeno.scripts.mit.edu Git - linux.git/commit
binder: prevent transactions to context manager from its own process.
authorHridya Valsaraju <hridya@google.com>
Mon, 15 Jul 2019 19:18:04 +0000 (12:18 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 24 Jul 2019 09:02:28 +0000 (11:02 +0200)
commit49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec
tree34e22e01f39b5099c525ad3857dee3b74dce275c
parenta56587065094fd96eb4c2b5ad65571daad32156d
binder: prevent transactions to context manager from its own process.

Currently, a transaction to context manager from its own process
is prevented by checking if its binder_proc struct is the same as
that of the sender. However, this would not catch cases where the
process opens the binder device again and uses the new fd to send
a transaction to the context manager.

Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/android/binder.c