linux/drivers/android
Schspa Shi aed86f8add binder: fix atomic sleep when get extended error
binder_inner_proc_lock(thread->proc) is a spin lock, copy_to_user can't
be called with in this lock.

Copy it as a local variable to fix it.

Fixes: bd32889e84 ("binder: add BINDER_GET_EXTENDED_ERROR ioctl")
Reported-by: syzbot+46fff6434a7f968ecb39@syzkaller.appspotmail.com
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Schspa Shi <schspa@gmail.com>
Link: https://lore.kernel.org/r/20220518011754.49348-1-schspa@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-05-19 18:41:33 +02:00
..
binder.c binder: fix atomic sleep when get extended error 2022-05-19 18:41:33 +02:00
binder_alloc.c binder: Use memcpy_{to,from}_page() in binder_alloc_do_buffer_copy() 2022-04-26 12:51:31 +02:00
binder_alloc.h binder: tell userspace to dump current backtrace when detected oneway spamming 2021-04-10 10:52:04 +02:00
binder_alloc_selftest.c binder: print warnings when detecting oneway spamming. 2020-09-03 18:24:41 +02:00
binder_internal.h binder: add BINDER_GET_EXTENDED_ERROR ioctl 2022-05-09 15:43:24 +02:00
binder_trace.h binder: add trace at free transaction. 2020-11-11 08:20:44 +01:00
binderfs.c binderfs: add extended_error feature entry 2022-05-09 15:43:24 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00