Carlos Llamas dafa5e9ab8 binder: fix potential UAF of target_{proc,thread} ... Commit 9474be34a7 ("binder: add failed transaction logging info") dereferences target_{proc,thread} after they have been potentially freed by binder_proc_dec_tmpref() and binder_thread_dec_tmpref(). This patch delays the release of the two references after their last usage. Fixes the following two errors reported by smatch: drivers/android/binder.c:3562 binder_transaction() error: dereferencing freed memory 'target_proc' drivers/android/binder.c:3563 binder_transaction() error: dereferencing freed memory 'target_thread' Fixes: 9474be34a7 ("binder: add failed transaction logging info") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Todd Kjos <tkjos@google.com> Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20220517185817.598872-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-05-19 18:41:26 +02:00
..
binder_alloc_selftest.c	binder: print warnings when detecting oneway spamming.	2020-09-03 18:24:41 +02:00
binder_alloc.c	binder: Use memcpy_{to,from}_page() in binder_alloc_do_buffer_copy()	2022-04-26 12:51:31 +02:00
binder_alloc.h	binder: tell userspace to dump current backtrace when detected oneway spamming	2021-04-10 10:52:04 +02:00
binder_internal.h	binder: add BINDER_GET_EXTENDED_ERROR ioctl	2022-05-09 15:43:24 +02:00
binder_trace.h	binder: add trace at free transaction.	2020-11-11 08:20:44 +01:00
binder.c	binder: fix potential UAF of target_{proc,thread}	2022-05-19 18:41:26 +02:00
binderfs.c	binderfs: add extended_error feature entry	2022-05-09 15:43:24 +02:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00