Todd Kjos a370003cc3 binder: fix possible UAF when freeing buffer ... There is a race between the binder driver cleaning up a completed transaction via binder_free_transaction() and a user calling binder_ioctl(BC_FREE_BUFFER) to release a buffer. It doesn't matter which is first but they need to be protected against running concurrently which can result in a UAF. Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-06-13 10:35:55 +02:00
..
binder_alloc_selftest.c
binder_alloc.c
binder_alloc.h
binder_internal.h
binder_trace.h
binder.c	binder: fix possible UAF when freeing buffer	2019-06-13 10:35:55 +02:00
binderfs.c
Kconfig
Makefile