binder: prevent transactions to context manager from its own process.
Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju <hridya@google.com> Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
a565870650
commit
49ed96943a
|
@ -2988,7 +2988,7 @@ static void binder_transaction(struct binder_proc *proc,
|
|||
else
|
||||
return_error = BR_DEAD_REPLY;
|
||||
mutex_unlock(&context->context_mgr_node_lock);
|
||||
if (target_node && target_proc == proc) {
|
||||
if (target_node && target_proc->pid == proc->pid) {
|
||||
binder_user_error("%d:%d got transaction to context manager from process owning it\n",
|
||||
proc->pid, thread->pid);
|
||||
return_error = BR_FAILED_REPLY;
|
||||
|
|
Loading…
Reference in a new issue