From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4AE06C76186 for ; Mon, 29 Jul 2019 19:57:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1E9E2204EC for ; Mon, 29 Jul 2019 19:57:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564430250; bh=4sXdNXPScPUynDeTvlfOIZNtQFPHYIYr4JtrETjXkEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jlFE7ac9MAOLh7BKmTipmlsMH4ps1hsD0eoHVyY1iowslgsgG7uXvjhtfuDyxd2Bw ZR8+umgSlQ5LbEpdG9264FZezCmYLSYzP4cypnlmauVAYdBcuMcnURo2/xwh15KaDA lUbSatCMVXAVuUzbZlwJSIpXp5QlCnf76G/dOPNE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2403756AbfG2T5Z (ORCPT ); Mon, 29 Jul 2019 15:57:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:47132 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2404043AbfG2Ty2 (ORCPT ); Mon, 29 Jul 2019 15:54:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AD85521773; Mon, 29 Jul 2019 19:54:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564430068; bh=4sXdNXPScPUynDeTvlfOIZNtQFPHYIYr4JtrETjXkEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SZ7XvDzTyJ4D2ksXp7pjDBTVQnn2xPT4ApLirjqL/yKCatO185BmPrIt7xr1CObs6 7Z+W7PWt+11MVC9FydiqWSFgpC3gkygFbBLEi2kfqo+g/q6qRGZcQf/Mr7zmk0fJUE 62ijR+jEZcjRCWzaA+sYVa3xcD35c06KNRG2LHi8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com, Hridya Valsaraju , Todd Kjos Subject: [PATCH 5.2 185/215] binder: prevent transactions to context manager from its own process. Date: Mon, 29 Jul 2019 21:23:01 +0200 Message-Id: <20190729190812.268949872@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190729190739.971253303@linuxfoundation.org> References: <20190729190739.971253303@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Hridya Valsaraju commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec upstream. Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju Acked-by: Todd Kjos Cc: stable Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2988,7 +2988,7 @@ static void binder_transaction(struct bi else return_error = BR_DEAD_REPLY; mutex_unlock(&context->context_mgr_node_lock); - if (target_node && target_proc == proc) { + if (target_node && target_proc->pid == proc->pid) { binder_user_error("%d:%d got transaction to context manager from process owning it\n", proc->pid, thread->pid); return_error = BR_FAILED_REPLY;