binder: protect against two threads freeing buffer

Adds protection against malicious user code freeing
the same buffer at the same time which could cause
a crash. Cannot happen under normal use.

Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 2 insertions, 2 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 3bbfb2455b70..a1912a22c89c 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2024,8 +2024,8 @@ static int binder_thread_write(struct binder_proc *proc,
                                 return -EFAULT;
                         ptr += sizeof(binder_uintptr_t);
 
-                        buffer = binder_alloc_buffer_lookup(&proc->alloc,
-                                                            data_ptr);
+                        buffer = binder_alloc_prepare_to_free(&proc->alloc,
+                                                              data_ptr);
                         if (buffer == NULL) {
                                 binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
                                         proc->pid, thread->pid, (u64)data_ptr);