shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-25 20:10:23 +09:00
Code Issues Packages Projects Releases Wiki Activity

FROMGIT: binder: fix async space check for 0-sized buffers

Browse Source 
Move the padding of 0-sized buffers to an earlier stage to account for
this round up during the alloc->free_async_space check.

Fixes: 74310e06be ("android: binder: Move buffer out of area shared with user space")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-5-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 254650075
(cherry picked from commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb
 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 char-misc-next)
Change-Id: I0c3a2378fb7e9c534ffe015dee849196f83aa252
Signed-off-by: Carlos Llamas <cmllamas@google.com>
This commit is contained in:
Carlos Llamas
2023-12-01 17:21:33 +00:00
committed by Treehugger Robot
parent 1787dddd97
commit 65cf1585ea
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/android/binder_alloc.c
View File

@@ -409,6 +409,10 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
return ERR_PTR(-EINVAL);
}
trace_android_vh_binder_alloc_new_buf_locked(size, &alloc->free_async_space, is_async);
/* Pad 0-size buffers so they get assigned unique addresses */
size = max(size, sizeof(void *));
if (is_async &&
alloc->free_async_space < size + sizeof(struct binder_buffer)) {
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
@@ -417,9 +421,6 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
return ERR_PTR(-ENOSPC);
}
/* Pad 0-size buffers so they get assigned unique addresses */
size = max(size, sizeof(void *));
while (n) {
buffer = rb_entry(n, struct binder_buffer, rb_node);
BUG_ON(!buffer->free);