From a79f41ed9786b75ebe75e52295ad54049b8551b6 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Wed, 15 Aug 2012 18:23:36 -0400 Subject: binder: don't allow mmap() by process other than proc->tsk we really shouldn't do get_files_struct() on a different process and use it to modify the sucker later on. Signed-off-by: Al Viro --- drivers/staging/android/binder.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'drivers/staging') diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 574e99210c3..b9a534c46aa 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -2793,6 +2793,9 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) const char *failure_string; struct binder_buffer *buffer; + if (proc->tsk != current) + return -EINVAL; + if ((vma->vm_end - vma->vm_start) > SZ_4M) vma->vm_end = vma->vm_start + SZ_4M; @@ -2857,7 +2860,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) binder_insert_free_buffer(proc, buffer); proc->free_async_space = proc->buffer_size / 2; barrier(); - proc->files = get_files_struct(proc->tsk); + proc->files = get_files_struct(current); proc->vma = vma; proc->vma_vm_mm = vma->vm_mm; -- cgit v1.2.3