Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 773fc2f1 authored by Martijn Coenen's avatar Martijn Coenen Committed by Prasad Sodagudi
Browse files

android: binder: use copy_from_user_preempt_disabled 



To keep the driver consistent, and until we have
fine-grained locking in place.

Change-Id: Idda7ae8df889b5fae5e96bf343ab17782b4c46b1
Signed-off-by: default avatarMartijn Coenen <maco@android.com>
Git-repo: https://android.googlesource.com/kernel/common


Git-commit: 288f5164a4e434939ae92b86dae2768e57ca41ac
Signed-off-by: default avatarPrasad Sodagudi <psodagud@codeaurora.org>
parent 35731dbb

drivers/android/binder.c

+6 −4
Original line number Diff line number Diff line
@@ -2221,7 +2221,8 @@ static void binder_transaction(struct binder_proc *proc, 
				return_error = BR_FAILED_REPLY;

				goto err_bad_offset;

			}

			if (copy_from_user(sg_bufp,

			if (copy_from_user_preempt_disabled(

					sg_bufp,

					(const void __user *)(uintptr_t)

					bp->buffer, bp->length)) {

				binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
@@ -2511,7 +2512,8 @@ static int binder_thread_write(struct binder_proc *proc, 
		case BC_REPLY_SG: {

			struct binder_transaction_data_sg tr;



			if (copy_from_user(&tr, ptr, sizeof(tr)))

			if (copy_from_user_preempt_disabled(&tr, ptr,

							    sizeof(tr)))

				return -EFAULT;

			ptr += sizeof(tr);

			binder_transaction(proc, thread, &tr.transaction_data,