shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-08 20:07:46 +09:00
Code Issues Packages Projects Releases Wiki Activity

Android Security Bulletin - November 2019-11 - Kernel components binder driver - CVE-2019-2214 [1/1]

Browse Source 
PD#OTT-6799

Problem:
In case the target node requests a security context, the
extra_buffers_size is increased with the size of the security context.
But, that size is not available for use by regular scatter-gather
buffers;

Solution:
make sure the ending of that buffer is marked correctly.

Verify:
Raven

Change-Id: I896f86a92a4b937a7a731ce9839ff53a700b298a
Signed-off-by: Martijn Coenen <maco at android.com>
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
This commit is contained in:
Martijn Coenen
2019-10-17 17:16:26 +08:00
committed by Luke Go
parent 99effa825b
commit de02da7990
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/android/binder.c
View File

@@ -3334,7 +3334,8 @@ static void binder_transaction(struct binder_proc *proc,
buffer_offset = off_start_offset;
off_end_offset = off_start_offset + tr->offsets_size;
sg_buf_offset = ALIGN(off_end_offset, sizeof(void *));
sg_buf_end_offset = sg_buf_offset + extra_buffers_size;
sg_buf_end_offset = sg_buf_offset + extra_buffers_size -
ALIGN(secctx_sz, sizeof(u64));
off_min = 0;
for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
buffer_offset += sizeof(binder_size_t)) {