[PATCH v2 0/2] binder: fix premature fd_install() and buffer leak on read -EFAULT

[Hui Peng <benquike@gmail.com>]

This series fixes two error-handling issues in binder_thread_read():

1. Defer fd_install() until after put_user() and copy_to_user() succeed,
   preventing file descriptors from being prematurely installed into the
   recipient process's file descriptor table when userspace copy fails.
2. Call binder_free_buf() on -EFAULT error paths in binder_thread_read() so
   the transaction buffer and associated node/ref references are freed.

Changes in v2:
- Split into a 2-patch series with separate single-purpose commits as
  requested by Greg Kroah-Hartman and Carlos Llamas.
- Added Reviewed-by tag from Carlos Llamas.

Hui Peng (2):
  binder: defer fd_install() until after copy_to_user() in binder_thread_read()
  binder: free transaction buffer via binder_free_buf() on read -EFAULT

 drivers/android/binder.c | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)