Xu YiPing d53bebdf4d binder: fix memory corruption in binder_transaction binder ... commit 7a4408c6bd ("binder: make sure accesses to proc/thread are safe") made a change to enqueue tcomplete to thread->todo before enqueuing the transaction. However, in err_dead_proc_or_thread case, the tcomplete is directly freed, without dequeued. It may cause the thread->todo list to be corrupted. So, dequeue it before freeing. Fixes: 7a4408c6bd ("binder: make sure accesses to proc/thread are safe") Signed-off-by: Xu YiPing <xuyiping@hisilicon.com> Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-09-18 16:06:00 +02:00
..
Kconfig	android: binder: Add allocator selftest	2017-08-28 16:47:17 +02:00
Makefile	android: binder: Add allocator selftest	2017-08-28 16:47:17 +02:00
binder.c	binder: fix memory corruption in binder_transaction binder	2017-09-18 16:06:00 +02:00
binder_alloc.c	android: binder: Add page usage in binder stats	2017-09-01 08:53:32 +02:00
binder_alloc.h	android: binder: Add page usage in binder stats	2017-09-01 08:53:32 +02:00
binder_alloc_selftest.c	android: binder: Add global lru shrinker to binder	2017-08-28 16:47:17 +02:00
binder_trace.h	android: binder: Add shrinker tracepoints	2017-08-28 16:47:17 +02:00