linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-11 07:30:16 +00:00

History

Todd Kjos bb4a2e48d5 binder: return errors from buffer copy functions

The buffer copy functions assumed the caller would ensure
correct alignment and that the memory to be copied was
completely within the binder buffer. There have been
a few cases discovered by syzkallar where a malformed
transaction created by a user could violated the
assumptions and resulted in a BUG_ON.

The fix is to remove the BUG_ON and always return the
error to be handled appropriately by the caller.

Acked-by: Martijn Coenen <maco@android.com>
Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com
Fixes: bde4a19fc04f ("binder: use userspace pointer as base of buffer space")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-07-01 08:42:47 +02:00

binder_alloc_selftest.c

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282

2019-06-05 17:36:37 +02:00

binder_alloc.c

binder: return errors from buffer copy functions

2019-07-01 08:42:47 +02:00

binder_alloc.h

binder: return errors from buffer copy functions

2019-07-01 08:42:47 +02:00

binder_internal.h

binderfs: remove separate device_initcall()