Skip to content

Commit

Permalink
fix use-after-free in adbd_auth
Browse files Browse the repository at this point in the history
The writev call is using references to data from the packet after it's
popped from the queue. This was discovered in GrapheneOS due to using
zero-on-free by default. It ends up resulting in adb being unable to
persistently whitelist keys.

Change-Id: Ibd9c1c4170bfe632b598b7666d09e4ce939a9e95
  • Loading branch information
thestinger committed Sep 7, 2021
1 parent 6ff4e66 commit 1f05db9
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions libs/adbd_auth/adbd_auth.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -282,9 +282,8 @@ struct AdbdAuthContext {
LOG(FATAL) << "adbd_auth: unhandled packet type?";
}

output_queue_.pop_front();

ssize_t rc = writev(framework_fd_.get(), iovs, iovcnt);
output_queue_.pop_front();
if (rc == -1 && errno != EAGAIN && errno != EWOULDBLOCK) {
PLOG(ERROR) << "adbd_auth: failed to write to framework fd";
ReplaceFrameworkFd(unique_fd());
Expand Down

0 comments on commit 1f05db9

Please sign in to comment.