Todd Kjos cfd0d84ba2 binder: fix async_free_space accounting for empty parcels ... In 4.13, commit 74310e06be ("android: binder: Move buffer out of area shared with user space") fixed a kernel structure visibility issue. As part of that patch, sizeof(void *) was used as the buffer size for 0-length data payloads so the driver could detect abusive clients sending 0-length asynchronous transactions to a server by enforcing limits on async_free_size. Unfortunately, on the "free" side, the accounting of async_free_space did not add the sizeof(void *) back. The result was that up to 8-bytes of async_free_space were leaked on every async transaction of 8-bytes or less. These small transactions are uncommon, so this accounting issue has gone undetected for several years. The fix is to use "buffer_size" (the allocated buffer size) instead of "size" (the logical buffer size) when updating the async_free_space during the free operation. These are the same except for this corner case of asynchronous transactions with payloads < 8 bytes. Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org # 4.14+ Link: https://lore.kernel.org/r/20211220190150.2107077-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-21 11:07:34 +01:00
..
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
binder.c	binder: use wake_up_pollfree()	2021-12-09 10:49:56 -08:00
binder_alloc.c	binder: fix async_free_space accounting for empty parcels	2021-12-21 11:07:34 +01:00
binder_alloc.h	binder: tell userspace to dump current backtrace when detected oneway spamming	2021-04-10 10:52:04 +02:00
binder_alloc_selftest.c	binder: print warnings when detecting oneway spamming.	2020-09-03 18:24:41 +02:00
binder_internal.h	selinux/stable-5.16 PR 20211101	2021-11-01 21:06:18 -07:00
binder_trace.h	binder: add trace at free transaction.	2020-11-11 08:20:44 +01:00
binderfs.c	binderfs: add support for feature files	2021-07-21 13:46:36 +02:00