• Todd Kjos's avatar
    binder: use atomic for transaction_log index · d99c7333
    Todd Kjos authored
    The log->next index for the transaction log was
    not protected when incremented. This led to a
    case where log->next++ resulted in an index
    larger than ARRAY_SIZE(log->entry) and eventually
    a bad access to memory.
    
    Fixed by making the log index an atomic64 and
    converting to an array by using "% ARRAY_SIZE(log->entry)"
    
    Also added "complete" field to the log entry which is
    written last to tell the print code whether the
    entry is complete
    Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    d99c7333
binder.c 109 KB