From 0d37d64f02e18a301867ae7684c3801bd99c5df2 Mon Sep 17 00:00:00 2001 From: Martijn Coenen Date: Tue, 8 Nov 2016 20:12:16 +0100 Subject: [PATCH] Android: binder: check set_context_mgr permission on time. Bug: 32394425 Change-Id: I860c6aab97850bff05a56e96cd3f4b41691bfd96 Signed-off-by: Martijn Coenen --- drivers/staging/android/binder.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index ad902dbac8fa5..56f9713de523c 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -2784,6 +2784,9 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp) ret = -EBUSY; goto out; } + ret = security_binder_set_context_mgr(proc->tsk); + if (ret < 0) + goto out; if (uid_valid(binder_context_mgr_uid)) { if (!uid_eq(binder_context_mgr_uid, curr_euid)) { pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", @@ -2849,9 +2852,6 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) ret = binder_ioctl_set_ctx_mgr(filp); if (ret) goto err; - ret = security_binder_set_context_mgr(proc->tsk); - if (ret < 0) - goto err; break; case BINDER_THREAD_EXIT: binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",