Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'char-misc-5.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull binder fix from Greg KH:
"This is a single binder fix to resolve a reported issue by Jann. It's
been in linux-next for a while with no reported issues"
* tag 'char-misc-5.4-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
binder: Don't modify VMA bounds in ->mmap handler
+4
-9
-7
drivers/android/binder.c
-7
drivers/android/binder.c
···
97
97
#define SZ_1K 0x400
98
98
#endif
99
99
100
-
#ifndef SZ_4M
101
-
#define SZ_4M 0x400000
102
-
#endif
103
-
104
100
#define FORBIDDEN_MMAP_FLAGS (VM_WRITE)
105
101
106
102
enum {
···
5172
5176
5173
5177
if (proc->tsk != current->group_leader)
5174
5178
return -EINVAL;
5175
-
5176
-
if ((vma->vm_end - vma->vm_start) > SZ_4M)
5177
-
vma->vm_end = vma->vm_start + SZ_4M;
5178
5179
5179
5180
binder_debug(BINDER_DEBUG_OPEN_CLOSE,
5180
5181
"%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n",
+4
-2
drivers/android/binder_alloc.c
+4
-2
drivers/android/binder_alloc.c
···
22
22
#include <asm/cacheflush.h>
23
23
#include <linux/uaccess.h>
24
24
#include <linux/highmem.h>
25
+
#include <linux/sizes.h>
25
26
#include "binder_alloc.h"
26
27
#include "binder_trace.h"
27
28
···
690
689
alloc->buffer = (void __user *)vma->vm_start;
691
690
mutex_unlock(&binder_alloc_mmap_lock);
692
691
693
-
alloc->pages = kcalloc((vma->vm_end - vma->vm_start) / PAGE_SIZE,
692
+
alloc->buffer_size = min_t(unsigned long, vma->vm_end - vma->vm_start,
693
+
SZ_4M);
694
+
alloc->pages = kcalloc(alloc->buffer_size / PAGE_SIZE,
694
695
sizeof(alloc->pages[0]),
695
696
GFP_KERNEL);
696
697
if (alloc->pages == NULL) {
···
700
697
failure_string = "alloc page array";
701
698
goto err_alloc_pages_failed;
702
699
}
703
-
alloc->buffer_size = vma->vm_end - vma->vm_start;
704
700
705
701
buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
706
702
if (!buffer) {