Todd Kjos bb4a2e48d5 binder: return errors from buffer copy functions ... The buffer copy functions assumed the caller would ensure correct alignment and that the memory to be copied was completely within the binder buffer. There have been a few cases discovered by syzkallar where a malformed transaction created by a user could violated the assumptions and resulted in a BUG_ON. The fix is to remove the BUG_ON and always return the error to be handled appropriately by the caller. Acked-by: Martijn Coenen <maco@android.com> Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com Fixes: bde4a19fc0 ("binder: use userspace pointer as base of buffer space") Suggested-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-07-01 08:42:47 +02:00
..
binder_alloc_selftest.c
binder_alloc.c	binder: return errors from buffer copy functions	2019-07-01 08:42:47 +02:00
binder_alloc.h	binder: return errors from buffer copy functions	2019-07-01 08:42:47 +02:00
binder_internal.h
binder_trace.h
binder.c	binder: return errors from buffer copy functions	2019-07-01 08:42:47 +02:00
binderfs.c
Kconfig
Makefile