diff options
| author | Todd Kjos <tkjos@google.com> | 2019-06-10 09:14:25 -0700 |
|---|---|---|
| committer | Todd Kjos <tkjos@google.com> | 2019-08-05 08:56:38 -0700 |
| commit | 0e1b964ab45ea74a54c988228c777d3b701c265f (patch) | |
| tree | 668394f816b115d9c0f7397eb169354920c3af81 /net/lapb/lapb_in.c | |
| parent | 78a688fa830a4e9ff49de221ccc64bc26e54c531 (diff) | |
binder: binder: fix possible UAF when freeing buffer
There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.
Bug: 133758011
Change-Id: Ie1426ff3d00218d050d61ff77b333ddf8818b7c9
Signed-off-by: Todd Kjos <tkjos@google.com>
Diffstat (limited to 'net/lapb/lapb_in.c')
0 files changed, 0 insertions, 0 deletions