Todd Kjos 7c70644026 binder: fix async_free_space accounting for empty parcels ... commit cfd0d84ba28c18b531648c9d4a35ecca89ad9901 upstream. In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-01-05 12:34:59 +01:00
..
binder.c	binder: use wake_up_pollfree()	2021-12-14 10:18:06 +01:00
binder_alloc.c	binder: fix async_free_space accounting for empty parcels	2022-01-05 12:34:59 +01:00
binder_alloc.h	binder: fix race that allows malicious free of live buffer	2018-12-05 19:32:11 +01:00
binder_alloc_selftest.c	android: binder: Add global lru shrinker to binder	2017-08-28 16:47:17 +02:00
binder_trace.h	android: binder: Show extra_buffers_size in trace	2018-08-02 10:34:12 +02:00
Kconfig	android: binder: Drop dependency on !M68K	2018-07-07 17:44:52 +02:00
Makefile	android: binder: Add allocator selftest	2017-08-28 16:47:17 +02:00