binder: fix incorrect calculation for num_valid
commit5.4-rM2-2.2.x-imx-squashed1698174271
upstream. For BINDER_TYPE_PTR and BINDER_TYPE_FDA transactions, the num_valid local was calculated incorrectly causing the range check in binder_validate_ptr() to miss out-of-bounds offsets. Fixes:bde4a19fc0
("binder: use userspace pointer as base of buffer space") Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20191213202531.55010-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
a348e30570
commit
34d8a89fe1
|
@ -3314,7 +3314,7 @@ static void binder_transaction(struct binder_proc *proc,
|
|||
binder_size_t parent_offset;
|
||||
struct binder_fd_array_object *fda =
|
||||
to_binder_fd_array_object(hdr);
|
||||
size_t num_valid = (buffer_offset - off_start_offset) *
|
||||
size_t num_valid = (buffer_offset - off_start_offset) /
|
||||
sizeof(binder_size_t);
|
||||
struct binder_buffer_object *parent =
|
||||
binder_validate_ptr(target_proc, t->buffer,
|
||||
|
@ -3388,7 +3388,7 @@ static void binder_transaction(struct binder_proc *proc,
|
|||
t->buffer->user_data + sg_buf_offset;
|
||||
sg_buf_offset += ALIGN(bp->length, sizeof(u64));
|
||||
|
||||
num_valid = (buffer_offset - off_start_offset) *
|
||||
num_valid = (buffer_offset - off_start_offset) /
|
||||
sizeof(binder_size_t);
|
||||
ret = binder_fixup_parent(t, thread, bp,
|
||||
off_start_offset,
|
||||
|
|
Loading…
Reference in New Issue