summaryrefslogtreecommitdiffstats
path: root/drivers/android/binder_alloc.h
diff options
context:
space:
mode:
authorTodd Kjos <tkjos@android.com>2019-06-28 18:50:12 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-07-01 08:42:47 +0200
commitbb4a2e48d5100ed3ff614df158a636bca3c6bf9f (patch)
tree6ec6135c5266d2db45f834de382b5388fecde7c8 /drivers/android/binder_alloc.h
parentdt-bindings: imx-ocotp: Add i.MX8MM compatible (diff)
downloadlinux-bb4a2e48d5100ed3ff614df158a636bca3c6bf9f.tar.xz
linux-bb4a2e48d5100ed3ff614df158a636bca3c6bf9f.zip
binder: return errors from buffer copy functions
The buffer copy functions assumed the caller would ensure correct alignment and that the memory to be copied was completely within the binder buffer. There have been a few cases discovered by syzkallar where a malformed transaction created by a user could violated the assumptions and resulted in a BUG_ON. The fix is to remove the BUG_ON and always return the error to be handled appropriately by the caller. Acked-by: Martijn Coenen <maco@android.com> Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com Fixes: bde4a19fc04f ("binder: use userspace pointer as base of buffer space") Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android/binder_alloc.h')
-rw-r--r--drivers/android/binder_alloc.h22
1 files changed, 11 insertions, 11 deletions
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index 71bfa95f8e09..db9c1b984695 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -159,17 +159,17 @@ binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
const void __user *from,
size_t bytes);
-void binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- void *src,
- size_t bytes);
-
-void binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
- void *dest,
- struct binder_buffer *buffer,
- binder_size_t buffer_offset,
- size_t bytes);
+int binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ void *src,
+ size_t bytes);
+
+int binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
+ void *dest,
+ struct binder_buffer *buffer,
+ binder_size_t buffer_offset,
+ size_t bytes);
#endif /* _LINUX_BINDER_ALLOC_H */