Todd Kjos 9edfd065a0 binder: return errors from buffer copy functions ...

commit bb4a2e48d5 upstream.

The buffer copy functions assumed the caller would ensure
correct alignment and that the memory to be copied was
completely within the binder buffer. There have been
a few cases discovered by syzkallar where a malformed
transaction created by a user could violated the
assumptions and resulted in a BUG_ON.

The fix is to remove the BUG_ON and always return the
error to be handled appropriately by the caller.

Acked-by: Martijn Coenen <maco@android.com>
Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com
Fixes: bde4a19fc0 ("binder: use userspace pointer as base of buffer space")
Suggested-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-07-14 08:09:51 +02:00

..

binder_alloc_selftest.c

binder: fix sparse issue in binder_alloc_selftest.c

2019-02-14 08:13:56 +01:00

binder_alloc.c

binder: return errors from buffer copy functions

2019-07-14 08:09:51 +02:00

binder_alloc.h

binder: return errors from buffer copy functions

2019-07-14 08:09:51 +02:00

binder_internal.h

binderfs: remove separate device_initcall()

2019-02-01 15:50:26 +01:00

binder_trace.h

binder: use userspace pointer as base of buffer space

2019-02-12 10:43:57 +01:00

binder.c

binder: return errors from buffer copy functions

2019-07-14 08:09:51 +02:00

binderfs.c

binderfs: remove separate device_initcall()

2019-02-01 15:50:26 +01:00

Kconfig

binder: add functions to copy to/from binder buffers

2019-02-12 10:43:57 +01:00

Makefile

binder: implement binderfs

2018-12-19 09:40:13 +01:00