tag a6a7d3924553fca1fe9a4ee4786ecf40133d0294
tagger Todd Kjos <tkjos@google.com> Mon Nov 04 15:14:21 2019 -0800
object dc734d732df47182993f8b90ea19ad3ff971a554

https://source.android.com/security/bulletin/2019-11-01
CVE-2019-2213
CVE-2019-2214
CVE-2019-2215
CVE-2019-11833

commit dc734d732df47182993f8b90ea19ad3ff971a554
author Todd Kjos <tkjos@google.com> Mon Jun 10 09:14:25 2019 -0700
committer Todd Kjos <tkjos@google.com> Mon Nov 04 09:11:18 2019 -0800
tree 942f39de6790129c6a5e4551dfb488a5496161e5
parent 7dc56e310221922235e966603c0eb6113f9dc82d

binder: binder: fix possible UAF when freeing buffer

There is a race between the binder driver cleaning
up a completed transaction via binder_free_transaction()
and a user calling binder_ioctl(BC_FREE_BUFFER) to
release a buffer. It doesn't matter which is first but
they need to be protected against running concurrently
which can result in a UAF.

Bug: 133758011
Change-Id: Ie1426ff3d00218d050d61ff77b333ddf8818b7c9
Signed-off-by: Todd Kjos <tkjos@google.com>