diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2012-08-15 18:23:36 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2012-09-26 21:08:51 -0400 |
| commit | a79f41ed9786b75ebe75e52295ad54049b8551b6 (patch) | |
| tree | d693d2ec11da1a622266daa09e26167a3f66c123 /drivers | |
| parent | c921b40d6201f7ec7b1edf7ea9a844f93e1a27f4 (diff) | |
binder: don't allow mmap() by process other than proc->tsk
we really shouldn't do get_files_struct() on a different process
and use it to modify the sucker later on.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/staging/android/binder.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 574e99210c36..b9a534c46aac 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -2793,6 +2793,9 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) const char *failure_string; struct binder_buffer *buffer; + if (proc->tsk != current) + return -EINVAL; + if ((vma->vm_end - vma->vm_start) > SZ_4M) vma->vm_end = vma->vm_start + SZ_4M; @@ -2857,7 +2860,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) binder_insert_free_buffer(proc, buffer); proc->free_async_space = proc->buffer_size / 2; barrier(); - proc->files = get_files_struct(proc->tsk); + proc->files = get_files_struct(current); proc->vma = vma; proc->vma_vm_mm = vma->vm_mm; |