summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMartijn Coenen <maco@android.com>2019-07-09 14:09:23 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-07-24 12:02:10 +0300
commita56587065094fd96eb4c2b5ad65571daad32156d (patch)
tree7112c2085ed83993097fbb5b543534a1ff1979e8
parent333a2101f47c4360ee78bb827277615d405b1cf7 (diff)
downloadlinux-a56587065094fd96eb4c2b5ad65571daad32156d.tar.xz
binder: Set end of SG buffer area properly.
In case the target node requests a security context, the extra_buffers_size is increased with the size of the security context. But, that size is not available for use by regular scatter-gather buffers; make sure the ending of that buffer is marked correctly. Acked-by: Todd Kjos <tkjos@google.com> Fixes: ec74136ded79 ("binder: create node flag to request sender's security context") Signed-off-by: Martijn Coenen <maco@android.com> Cc: stable@vger.kernel.org # 5.1+ Link: https://lore.kernel.org/r/20190709110923.220736-1-maco@android.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/android/binder.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 38a59a630cd4..5bde08603fbc 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3239,7 +3239,8 @@ static void binder_transaction(struct binder_proc *proc,
buffer_offset = off_start_offset;
off_end_offset = off_start_offset + tr->offsets_size;
sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
- sg_buf_end_offset = sg_buf_offset + extra_buffers_size;
+ sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
+ ALIGN(secctx_sz, sizeof(u64));
off_min = 0;
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
buffer_offset += sizeof(binder_size_t)) {