Todd Kjos 103b16a8c5 binder: fix async_free_space accounting for empty parcels ... commit cfd0d84ba2 upstream. In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-01-05 12:37:46 +01:00
..
binder.c	binder: use wake_up_pollfree()	2021-12-14 14:49:02 +01:00
binder_alloc.c	binder: fix async_free_space accounting for empty parcels	2022-01-05 12:37:46 +01:00
binder_alloc.h	binder: add flag to clear buffer on txn complete	2020-12-30 11:51:35 +01:00
binder_alloc_selftest.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282	2019-06-05 17:36:37 +02:00
binder_internal.h	binder: prevent UAF for binderfs devices II	2020-03-12 13:00:17 +01:00
binder_trace.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282	2019-06-05 17:36:37 +02:00
binderfs.c	binderfs: use refcount for binder control devices too	2020-03-25 08:25:50 +01:00
Kconfig	binder: add functions to copy to/from binder buffers	2019-02-12 10:43:57 +01:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00