From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S939727AbcJXNXW (ORCPT ); Mon, 24 Oct 2016 09:23:22 -0400 Received: from mail-wm0-f54.google.com ([74.125.82.54]:35390 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S936464AbcJXNVG (ORCPT ); Mon, 24 Oct 2016 09:21:06 -0400 From: Martijn Coenen To: gregkh@linuxfoundation.org Cc: arve@android.com, linux-kernel@vger.kernel.org Subject: [PATCH 02/10] ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct Date: Mon, 24 Oct 2016 15:20:30 +0200 Message-Id: <1477315238-104062-3-git-send-email-maco@android.com> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 In-Reply-To: <1477315238-104062-1-git-send-email-maco@android.com> References: <1477315238-104062-1-git-send-email-maco@android.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Arve Hjønnevåg Prevents leaking pointers between processes Signed-off-by: Arve Hjønnevåg --- drivers/android/binder.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 3681759..3c71b98 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -1584,7 +1584,9 @@ static void binder_transaction(struct binder_proc *proc, fp->type = BINDER_TYPE_HANDLE; else fp->type = BINDER_TYPE_WEAK_HANDLE; + fp->binder = 0; fp->handle = ref->desc; + fp->cookie = 0; binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE, &thread->todo); @@ -1634,7 +1636,9 @@ static void binder_transaction(struct binder_proc *proc, return_error = BR_FAILED_REPLY; goto err_binder_get_ref_for_node_failed; } + fp->binder = 0; fp->handle = new_ref->desc; + fp->cookie = 0; binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL); trace_binder_transaction_ref_to_ref(t, ref, new_ref); @@ -1688,6 +1692,7 @@ static void binder_transaction(struct binder_proc *proc, binder_debug(BINDER_DEBUG_TRANSACTION, " fd %d -> %d\n", fp->handle, target_fd); /* TODO: fput? */ + fp->binder = 0; fp->handle = target_fd; } break; -- 2.8.0.rc3.226.g39d4020