Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 137c838f authored by Todd Kjos's avatar Todd Kjos Committed by Greg Kroah-Hartman
Browse files

Revert "binder: fix handling of misaligned binder object" 



This reverts commit 6bf7d3c5.

The commit message is for a different patch. Reverting and then adding
the same patch back with the correct commit message.

Reported-by: default avatarBen Hutchings <ben.hutchings@codethink.co.uk>
Cc: stable <stable@vger.kernel.org> # 4.19
Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 385dab29

drivers/android/binder_alloc.c

+10 −8
Original line number Original line Diff line number Diff line
@@ -958,13 +958,14 @@ enum lru_status binder_alloc_free_page(struct list_head *item, 




	index = page - alloc->pages;

	index = page - alloc->pages;

	page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;

	page_addr = (uintptr_t)alloc->buffer + index * PAGE_SIZE;



	vma = binder_alloc_get_vma(alloc);

	mm = alloc->vma_vm_mm;

	if (vma) {

	if (!mmget_not_zero(mm))

		if (!mmget_not_zero(alloc->vma_vm_mm))

			goto err_mmget;

			goto err_mmget;

		mm = alloc->vma_vm_mm;

		if (!down_write_trylock(&mm->mmap_sem))

		if (!down_write_trylock(&mm->mmap_sem))

			goto err_down_write_mmap_sem_failed;

			goto err_down_write_mmap_sem_failed;

	vma = binder_alloc_get_vma(alloc);

	}





	list_lru_isolate(lru, item);

	list_lru_isolate(lru, item);

	spin_unlock(lock);

	spin_unlock(lock);
@@ -977,9 +978,10 @@ enum lru_status binder_alloc_free_page(struct list_head *item, 
			       PAGE_SIZE);

			       PAGE_SIZE);





		trace_binder_unmap_user_end(alloc, index);

		trace_binder_unmap_user_end(alloc, index);

	}



		up_write(&mm->mmap_sem);

		up_write(&mm->mmap_sem);

		mmput(mm);

		mmput(mm);

	}





	trace_binder_unmap_kernel_start(alloc, index);

	trace_binder_unmap_kernel_start(alloc, index);