Eric Biggers f88982679f binder: check for binder_thread allocation failure in binder_poll() ...

If the kzalloc() in binder_get_thread() fails, binder_poll()
dereferences the resulting NULL pointer.

Fix it by returning POLLERR if the memory allocation failed.

This bug was found by syzkaller using fault injection.

Reported-by: syzbot <syzkaller@googlegroups.com>
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-02-16 11:15:44 +01:00

..

binder_alloc_selftest.c

android: binder: Add global lru shrinker to binder

2017-08-28 16:47:17 +02:00

binder_alloc.c

android: binder: use VM_ALLOC to get vm area

2018-01-25 10:46:42 +01:00

binder_alloc.h

android: binder: Check for errors in binder_alloc_shrinker_init().

2017-12-18 15:59:17 +01:00

binder_trace.h

android: binder: Add shrinker tracepoints

2017-08-28 16:47:17 +02:00

binder.c

binder: check for binder_thread allocation failure in binder_poll()

2018-02-16 11:15:44 +01:00

Kconfig

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Makefile

android: binder: Add allocator selftest

2017-08-28 16:47:17 +02:00