diff options
| author | Martijn Coenen <maco@android.com> | 2019-07-09 13:09:23 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-31 07:24:58 +0200 |
| commit | 01ca6aed36d0f7573854fb5c504696b2314a12f5 (patch) | |
| tree | 49310e85229db6d752027ed713548fc0997a6710 | |
| parent | ea449923454a69e75bade4dad45d66ee5198c73e (diff) | |
| download | linux-01ca6aed36d0f7573854fb5c504696b2314a12f5.tar.gz linux-01ca6aed36d0f7573854fb5c504696b2314a12f5.tar.bz2 linux-01ca6aed36d0f7573854fb5c504696b2314a12f5.zip | |
binder: Set end of SG buffer area properly.
commit a56587065094fd96eb4c2b5ad65571daad32156d upstream.
In case the target node requests a security context, the
extra_buffers_size is increased with the size of the security context.
But, that size is not available for use by regular scatter-gather
buffers; make sure the ending of that buffer is marked correctly.
Acked-by: Todd Kjos <tkjos@google.com>
Fixes: ec74136ded79 ("binder: create node flag to request sender's security context")
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable@vger.kernel.org # 5.1+
Link: https://lore.kernel.org/r/20190709110923.220736-1-maco@android.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/android/binder.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 38a59a630cd4..5bde08603fbc 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3239,7 +3239,8 @@ static void binder_transaction(struct binder_proc *proc, buffer_offset = off_start_offset; off_end_offset = off_start_offset + tr->offsets_size; sg_buf_offset = ALIGN(off_end_offset, sizeof(void *)); - sg_buf_end_offset = sg_buf_offset + extra_buffers_size; + sg_buf_end_offset = sg_buf_offset + extra_buffers_size - + ALIGN(secctx_sz, sizeof(u64)); off_min = 0; for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { |