evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

android: binder: use copy_from_user_preempt_disabled

Browse source 
To keep the driver consistent, and until we have
fine-grained locking in place.

Change-Id: Idda7ae8df889b5fae5e96bf343ab17782b4c46b1
Signed-off-by: Martijn Coenen <maco@android.com>
Git-repo: https://android.googlesource.com/kernel/common
Git-commit: 288f5164a4e434939ae92b86dae2768e57ca41ac
Signed-off-by: Prasad Sodagudi <psodagud@codeaurora.org>
This commit is contained in:
Martijn Coenen 2016-10-25 13:48:44 +02:00 • committed by Prasad Sodagudi
parent 35731dbb93
commit 773fc2f1ee
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/android/binder.c
View file

@ -2221,9 +2221,10 @@ static void binder_transaction(struct binder_proc *proc,
return_error = BR_FAILED_REPLY;
goto err_bad_offset;
}
if (copy_from_user(sg_bufp,
(const void __user *)(uintptr_t)
bp->buffer, bp->length)) {
if (copy_from_user_preempt_disabled(
sg_bufp,
(const void __user *)(uintptr_t)
bp->buffer, bp->length)) {
binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
proc->pid, thread->pid);
return_error = BR_FAILED_REPLY;
@ -2511,7 +2512,8 @@ static int binder_thread_write(struct binder_proc *proc,
case BC_REPLY_SG: {
struct binder_transaction_data_sg tr;
if (copy_from_user(&tr, ptr, sizeof(tr)))
if (copy_from_user_preempt_disabled(&tr, ptr,
sizeof(tr)))
return -EFAULT;
ptr += sizeof(tr);
binder_transaction(proc, thread, &tr.transaction_data,