Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5cb6135 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "staging: android: binder: Add deref_helper() macro"

parents 2f07e2c3 9f1988eb

drivers/staging/android/binder.c

+13 −12
Original line number Diff line number Diff line
@@ -142,6 +142,7 @@ module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 
	} while (0)



#define align_helper(ptr)	    ALIGN(ptr, sizeof(void *))

#define deref_helper(ptr)	    (*(typeof(size_t *))ptr)



enum binder_stat_types {

	BINDER_STAT_PROC,
@@ -1231,7 +1232,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, 
					      struct binder_buffer *buffer,

					      size_t *failed_at)

{

	size_t *offp, *off_end;

	void *offp, *off_end;

	int debug_id = buffer->debug_id;



	binder_debug(BINDER_DEBUG_TRANSACTION,
@@ -1247,16 +1248,16 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, 
		off_end = failed_at;

	else

		off_end = (void *)offp + buffer->offsets_size;

	for (; offp < off_end; offp++) {

	for (; offp < off_end; offp += sizeof(size_t)) {

		struct flat_binder_object *fp;

		if (*offp > buffer->data_size - sizeof(*fp) ||

		if (deref_helper(offp) > buffer->data_size - sizeof(*fp) ||

		    buffer->data_size < sizeof(*fp) ||

		    !IS_ALIGNED(*offp, sizeof(u32))) {

		    !IS_ALIGNED(deref_helper(offp), sizeof(u32))) {

			pr_err("transaction release %d bad offset %zd, size %zd\n",

			 debug_id, *offp, buffer->data_size);

			 debug_id, deref_helper(offp), buffer->data_size);

			continue;

		}

		fp = (struct flat_binder_object *)(buffer->data + *offp);

		fp = (struct flat_binder_object *)(buffer->data + deref_helper(offp));

		switch (fp->type) {

		case BINDER_TYPE_BINDER:

		case BINDER_TYPE_WEAK_BINDER: {
@@ -1306,7 +1307,7 @@ static void binder_transaction(struct binder_proc *proc, 
{

	struct binder_transaction *t;

	struct binder_work *tcomplete;

	size_t *offp, *off_end;

	void *offp, *off_end;

	struct binder_proc *target_proc;

	struct binder_thread *target_thread = NULL;

	struct binder_node *target_node = NULL;
@@ -1500,17 +1501,17 @@ static void binder_transaction(struct binder_proc *proc, 
		goto err_bad_offset;

	}

	off_end = (void *)offp + tr->offsets_size;

	for (; offp < off_end; offp++) {

	for (; offp < off_end; offp += sizeof(size_t)) {

		struct flat_binder_object *fp;

		if (*offp > t->buffer->data_size - sizeof(*fp) ||

		if (deref_helper(offp) > t->buffer->data_size - sizeof(*fp) ||

		    t->buffer->data_size < sizeof(*fp) ||

		    !IS_ALIGNED(*offp, sizeof(u32))) {

		    !IS_ALIGNED(deref_helper(offp), sizeof(u32))) {

			binder_user_error("%d:%d got transaction with invalid offset, %zd\n",

					proc->pid, thread->pid, *offp);

					proc->pid, thread->pid, deref_helper(offp));

			return_error = BR_FAILED_REPLY;

			goto err_bad_offset;

		}

		fp = (struct flat_binder_object *)(t->buffer->data + *offp);

		fp = (struct flat_binder_object *)(t->buffer->data + deref_helper(offp));

		switch (fp->type) {

		case BINDER_TYPE_BINDER:

		case BINDER_TYPE_WEAK_BINDER: {