From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75DFAC433FF for ; Mon, 29 Jul 2019 19:57:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4275E204EC for ; Mon, 29 Jul 2019 19:57:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564430248; bh=4sXdNXPScPUynDeTvlfOIZNtQFPHYIYr4JtrETjXkEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=HR77dAvC1dlX2eqygcyjHFS5WSHFQ9rqtzCqdcTGbUnxg2L+2eJvmIMnvUhJoL5nJ JhcCEe4t11poh1xscnLFtzfMbn5KcHK0A0/8+dczJu7A+QNXoohIvduwF+CteoTHiw OalDQK2Vz7UdgBGzU8itLSDGj/sxvC2OHXNGjzlk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404049AbfG2T51 (ORCPT ); Mon, 29 Jul 2019 15:57:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:47132 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2404043AbfG2Ty2 (ORCPT ); Mon, 29 Jul 2019 15:54:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AD85521773; Mon, 29 Jul 2019 19:54:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1564430068; bh=4sXdNXPScPUynDeTvlfOIZNtQFPHYIYr4JtrETjXkEk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SZ7XvDzTyJ4D2ksXp7pjDBTVQnn2xPT4ApLirjqL/yKCatO185BmPrIt7xr1CObs6 7Z+W7PWt+11MVC9FydiqWSFgpC3gkygFbBLEi2kfqo+g/q6qRGZcQf/Mr7zmk0fJUE 62ijR+jEZcjRCWzaA+sYVa3xcD35c06KNRG2LHi8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com, Hridya Valsaraju , Todd Kjos Subject: [PATCH 5.2 185/215] binder: prevent transactions to context manager from its own process. Date: Mon, 29 Jul 2019 21:23:01 +0200 Message-Id: <20190729190812.268949872@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190729190739.971253303@linuxfoundation.org> References: <20190729190739.971253303@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Hridya Valsaraju commit 49ed96943a8e0c62cc5a9b0a6cfc88be87d1fcec upstream. Currently, a transaction to context manager from its own process is prevented by checking if its binder_proc struct is the same as that of the sender. However, this would not catch cases where the process opens the binder device again and uses the new fd to send a transaction to the context manager. Reported-by: syzbot+8b3c354d33c4ac78bfad@syzkaller.appspotmail.com Signed-off-by: Hridya Valsaraju Acked-by: Todd Kjos Cc: stable Link: https://lore.kernel.org/r/20190715191804.112933-1-hridya@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2988,7 +2988,7 @@ static void binder_transaction(struct bi else return_error = BR_DEAD_REPLY; mutex_unlock(&context->context_mgr_node_lock); - if (target_node && target_proc == proc) { + if (target_node && target_proc->pid == proc->pid) { binder_user_error("%d:%d got transaction to context manager from process owning it\n", proc->pid, thread->pid); return_error = BR_FAILED_REPLY;