51d8a7eca6
When a binder transaction is initiated on a binder device coming from a
binderfs instance, a pointer to the name of the binder device is stashed
in the binder_transaction_log_entry's context_name member. Later on it
is used to print the name in print_binder_transaction_log_entry(). By
the time print_binder_transaction_log_entry() accesses context_name
binderfs_evict_inode() might have already freed the associated memory
thereby causing a UAF. Do the simple thing and prevent this by copying
the name of the binder device instead of stashing a pointer to it.
Reported-by: Jann Horn <jannh@google.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| binder_alloc_selftest.c | ||
| binder_alloc.c | ||
| binder_alloc.h | ||
| binder_internal.h | ||
| binder_trace.h | ||
| binder.c | ||
| binderfs.c | ||
| Kconfig | ||
| Makefile | ||