summaryrefslogtreecommitdiff
path: root/drivers/android
diff options
context:
space:
mode:
authorXu YiPing <xuyiping@hisilicon.com>2017-09-05 10:21:52 -0700
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-09-18 16:06:00 +0200
commitd53bebdf4d779497b29e1aad26e19cac1d446f42 (patch)
tree1cb59a7d0c0f4dc4d59536e5c75ccdc1f9f390d6 /drivers/android
parent52b81611f209da5f49019260522633e994e241b5 (diff)
binder: fix memory corruption in binder_transaction binder
commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe") made a change to enqueue tcomplete to thread->todo before enqueuing the transaction. However, in err_dead_proc_or_thread case, the tcomplete is directly freed, without dequeued. It may cause the thread->todo list to be corrupted. So, dequeue it before freeing. Fixes: 7a4408c6bd3e ("binder: make sure accesses to proc/thread are safe") Signed-off-by: Xu YiPing <xuyiping@hisilicon.com> Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android')
-rw-r--r--drivers/android/binder.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index b257bb0e2cfe..ab34239a76ee 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3082,6 +3082,7 @@ static void binder_transaction(struct binder_proc *proc,
err_dead_proc_or_thread:
return_error = BR_DEAD_REPLY;
return_error_line = __LINE__;
+ binder_dequeue_work(proc, tcomplete);
err_translate_failed:
err_bad_object_type:
err_bad_offset: