ANDROID: binder: prevent transactions into own process.
PATCH v2 1/1 ANDROID: binder: prevent transactions into own process.
This can't happen with normal nodes (because you can't get a ref to a node you own), but it could happen with the context manager; to make the behavior consistent with regular nodes, reject transactions into the context manager by the process owning it.
Reported-by [email protected]
Signed-off-by Martijn Coenen <[email protected]>
---
Changed in v2:
- Use target_proc directly to avoid dereference.
drivers/android/binder.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/android/binder.c +8 -0
@@ -2839,6 +2839,14 @@ static void binder_transaction(struct binder_proc *proc,else return_error =BR_DEAD_REPLY ;mutex_unlock (&context->context_mgr_node_lock); +if (target_node && target_proc == proc) { +binder_user_error ("%d:%d got transaction to context manager from process owning it\n" , + proc->pid, thread->pid); + return_error =BR_FAILED_REPLY ; + return_error_param = -EINVAL ; + return_error_line = __LINE__; + goto err_invalid_target_handle; + } }if (!target_node) {/*
Signature · 1 line
2.17.0.rc1.321.gba9d0f2565-goog