Todd Kjos
154e67bd72
commit 4d5b5539742d2554591751b4248b0204d20dcc9d upstream. Use the 'struct cred' saved at binder_open() to lookup the security ID via security_cred_getsecid(). This ensures that the security context that opened binder is the one used to generate the secctx. Mot-CRs-fixed: (CR) CVE-Fixed: CVE-2021-39686 Bug: 200688826 Cc: stable@vger.kernel.org # 5.4+ Fixes: ec74136ded79 ("binder: create node flag to request sender's security context") Signed-off-by: Todd Kjos <tkjos@google.com> Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com> Reported-by: kernel test robot <lkp@intel.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> Change-Id: Ia7b59804a0bdbd51191bbcca556414840307c623 Bug: 200688826 Signed-off-by: Todd Kjos <tkjos@google.com> Signed-off-by: Gajjala Chakradhar <gajjalac@motorola.com> Reviewed-on: https://gerrit.mot.com/2190144 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Konstantin Makariev <kmakariev@motorola.com> Submit-Approved: Jira Key