Todd Kjos 524ad00e80 binder: fix memory leak in error path ... commit 1909a671db upstream. syzkallar found a 32-byte memory leak in a rarely executed error case. The transaction complete work item was not freed if put_user() failed when writing the BR_TRANSACTION_COMPLETE to the user command buffer. Fixed by freeing it before put_user() is called. Reported-by: syzbot+182ce46596c3f2e1eb24@syzkaller.appspotmail.com Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-07-14 08:11:21 +02:00
..
binder.c	binder: fix memory leak in error path	2019-07-14 08:11:21 +02:00
binder_alloc.c	binder: fix race between munmap() and direct reclaim	2019-06-09 09:17:23 +02:00
binder_alloc.h	binder: fix race that allows malicious free of live buffer	2018-12-05 19:32:11 +01:00
binder_alloc_selftest.c	android: binder: Add global lru shrinker to binder	2017-08-28 16:47:17 +02:00
binder_trace.h	android: binder: Show extra_buffers_size in trace	2018-08-02 10:34:12 +02:00
Kconfig	android: binder: Drop dependency on !M68K	2018-07-07 17:44:52 +02:00
Makefile	android: binder: Add allocator selftest	2017-08-28 16:47:17 +02:00