diff options
| author | Martijn Coenen <maco@android.com> | 2019-07-09 13:09:23 +0200 |
|---|---|---|
| committer | Martijn Coenen <maco@google.com> | 2019-07-24 11:18:08 +0000 |
| commit | db3af59b11dac73fa67cdc4f3052ef51c6fd06e7 (patch) | |
| tree | 858d747e6d45f6f787a8e3a377af52d9cd0860c6 | |
| parent | cf682cc8e37d0191ca9c6d5f2092c3e0147f647e (diff) | |
BACKPORT: binder: Set end of SG buffer area properly.
In case the target node requests a security context, the
extra_buffers_size is increased with the size of the security context.
But, that size is not available for use by regular scatter-gather
buffers; make sure the ending of that buffer is marked correctly.
Bug: 136210786
Acked-by: Todd Kjos <tkjos@google.com>
Fixes: ec74136ded79 ("binder: create node flag to request sender's security context")
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable@vger.kernel.org # 5.1+
Link: https://lore.kernel.org/r/20190709110923.220736-1-maco@android.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a56587065094fd96eb4c2b5ad65571daad32156d)
| -rw-r--r-- | drivers/android/binder.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c index bd43360458fd..a3c0f5f2b230 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3225,7 +3225,8 @@ static void binder_transaction(struct binder_proc *proc, } off_end = (void *)off_start + tr->offsets_size; sg_bufp = (u8 *)(PTR_ALIGN(off_end, sizeof(void *))); - sg_buf_end = sg_bufp + extra_buffers_size; + sg_buf_end = sg_bufp + extra_buffers_size - + ALIGN(secctx_sz, sizeof(u64)); off_min = 0; for (; offp < off_end; offp++) { struct binder_object_header *hdr; |