Eric Biggers 4be5a28104 binder: check for binder_thread allocation failure in binder_poll() ... commit f88982679f upstream. If the kzalloc() in binder_get_thread() fails, binder_poll() dereferences the resulting NULL pointer. Fix it by returning POLLERR if the memory allocation failed. This bug was found by syzkaller using fault injection. Reported-by: syzbot <syzkaller@googlegroups.com> Fixes: 457b9a6f09 ("Staging: android: add binder driver") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-02-25 11:05:44 +01:00
..
Kconfig	staging: android: binder: move to the "real" part of the kernel	2014-10-20 10:30:15 +08:00
Makefile	staging: android: binder: move to the "real" part of the kernel	2014-10-20 10:30:15 +08:00
binder.c	binder: check for binder_thread allocation failure in binder_poll()	2018-02-25 11:05:44 +01:00
binder_trace.h	staging: android: binder: move to the "real" part of the kernel	2014-10-20 10:30:15 +08:00