lkml.org 
[lkml]   [2021]   [Nov]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
Subject[PATCH v2 0/4] binder: Prevent untranslated sender data from being copied to target
From
Binder copies transactions directly from the sender buffer
to the target buffer and then fixes up BINDER_TYPE_PTR and
BINDER_TYPE_FDA objects. This means there is a brief time
when sender pointers and fds are visible to the target
process.

This series reworks the the sender to target copy to
avoid leaking any untranslated sender data from being
visible in the target.

Todd Kjos (4):
binder: binder: fix handling of error during copy
binder: defer copies of pre-patched txn data
binder: read pre-translated fds from sender buffer
binder: avoid potential data leakage when copying txn

v2:
- add "binder: fix handling of error during copy" to fix
bug noticed by Dan Carpenter
- address Dan Carpenter's comments

drivers/android/binder.c | 442 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------
1 file changed, 387 insertions(+), 55 deletions(-)

\
 
 \ /
  Last update: 2021-11-30 19:53    [W:0.261 / U:0.260 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site