• Todd Kjos's avatar
    binder: fix use-after-free in binder_transaction() · 512cf465
    Todd Kjos authored
    User-space normally keeps the node alive when creating a transaction
    since it has a reference to the target. The local strong ref keeps it
    alive if the sending process dies before the target process processes
    the transaction. If the source process is malicious or has a reference
    counting bug, this can fail.
    
    In this case, when we attempt to decrement the node in the failure
    path, the node has already been freed.
    
    This is fixed by taking a tmpref on the node while constructing
    the transaction. To avoid re-acquiring the node lock and inner
    proc lock to increment the proc's tmpref, a helper is used that
    does the ref increments on both the node and proc.
    Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
    Cc: stable <stable@vger.kernel.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    512cf465
binder.c 158 KB