UPSTREAM: binder: avoid potential data leakage when copying txn

Transactions are copied from the sender to the target
first and objects like BINDER_TYPE_PTR and BINDER_TYPE_FDA
are then fixed up. This means there is a short period where
the sender's version of these objects are visible to the
target prior to the fixups.

Instead of copying all of the data first, copy data only
after any needed fixups have been applied.

Fixes: 457b9a6f ("Staging: android: add binder driver")
Reviewed-by: Martijn Coenen <maco@android.com>
Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20211130185152.437403-3-tkjos@google.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 137131904
Bug: 257685302
Bug: 260704666
(cherry picked from commit 6d98eb95)
[cmllamas: fix trivial merge conflict]
Change-Id: I8c14a03a2ee23c5f060c82e1626686f72eff33d9
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Robin Peng <robinpeng@google.com>