binder: prevent UAF read in print_binder_transaction_log_entry()

When a binder transaction is initiated on a binder device coming from a
binderfs instance, a pointer to the name of the binder device is stashed
in the binder_transaction_log_entry's context_name member. Later on it
is used to print the name in print_binder_transaction_log_entry(). By
the time print_binder_transaction_log_entry() accesses context_name
binderfs_evict_inode() might have already freed the associated memory
thereby causing a UAF. Do the simple thing and prevent this by copying
the name of the binder device instead of stashing a pointer to it.

Reported-by: Jann Horn <>
Fixes: 03e2e07e3814 ("binder: Make transaction_log available in binderfs")
Cc: Joel Fernandes <>
Cc: Todd Kjos <>
Cc: Hridya Valsaraju <>
Signed-off-by: Christian Brauner <>
2 files changed