diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-05-02 14:49:24 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-05-02 14:49:24 +0300 |
| commit | 35a7609639c49f76f13f206402cbf692c4ae3e4e (patch) | |
| tree | 55c8cf59f8bac0754eff06a3f102d2d819dc39ed /drivers/android/binder.c | |
| parent | e918c10265ef2bc82ce8a6fed6d8123d09ec1db3 (diff) | |
| parent | 672c0c5173427e6b3e2a9bbb7be51ceeec78093a (diff) | |
| download | linux-35a7609639c49f76f13f206402cbf692c4ae3e4e.tar.xz | |
Merge 5.18-rc5 into char-misc-next
We need the char-misc fixes in here as well.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android/binder.c')
| -rw-r--r-- | drivers/android/binder.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c index bfadc0c4a442..5ffdad274301 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2298,6 +2298,7 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc, { int ret = 0; struct binder_sg_copy *sgc, *tmpsgc; + struct binder_ptr_fixup *tmppf; struct binder_ptr_fixup *pf = list_first_entry_or_null(pf_head, struct binder_ptr_fixup, node); @@ -2352,7 +2353,11 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc, list_del(&sgc->node); kfree(sgc); } - BUG_ON(!list_empty(pf_head)); + list_for_each_entry_safe(pf, tmppf, pf_head, node) { + BUG_ON(pf->skip_size == 0); + list_del(&pf->node); + kfree(pf); + } BUG_ON(!list_empty(sgc_head)); return ret > 0 ? -EINVAL : ret; @@ -2489,6 +2494,9 @@ static int binder_translate_fd_array(struct list_head *pf_head, struct binder_proc *proc = thread->proc; int ret; + if (fda->num_fds == 0) + return 0; + fd_buf_size = sizeof(u32) * fda->num_fds; if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n", |