diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2022-11-30 00:04:52 +0300 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-11-30 00:04:52 +0300 |
| commit | f2bb566f5c977ff010baaa9e5e14d9a75b06e5f2 (patch) | |
| tree | 6359cc9169bd06bfb8b757a534c82886df605b71 /drivers/android/binder_alloc.c | |
| parent | 7a945ce0c19bbdf821d5f7ce1515e7fb8e444465 (diff) | |
| parent | 01f856ae6d0ca5ad0505b79bf2d22d7ca439b2a1 (diff) | |
| download | linux-f2bb566f5c977ff010baaa9e5e14d9a75b06e5f2.tar.xz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
tools/lib/bpf/ringbuf.c
927cbb478adf ("libbpf: Handle size overflow for ringbuf mmap")
b486d19a0ab0 ("libbpf: checkpatch: Fixed code alignments in ringbuf.c")
https://lore.kernel.org/all/20221121122707.44d1446a@canb.auug.org.au/
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers/android/binder_alloc.c')
| -rw-r--r-- | drivers/android/binder_alloc.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 1c39cfce32fa..4ad42b0f75cd 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -739,6 +739,12 @@ int binder_alloc_mmap_handler(struct binder_alloc *alloc, const char *failure_string; struct binder_buffer *buffer; + if (unlikely(vma->vm_mm != alloc->mm)) { + ret = -EINVAL; + failure_string = "invalid vma->vm_mm"; + goto err_invalid_mm; + } + mutex_lock(&binder_alloc_mmap_lock); if (alloc->buffer_size) { ret = -EBUSY; @@ -785,6 +791,7 @@ err_alloc_pages_failed: alloc->buffer_size = 0; err_already_mapped: mutex_unlock(&binder_alloc_mmap_lock); +err_invalid_mm: binder_alloc_debug(BINDER_DEBUG_USER_ERROR, "%s: %d %lx-%lx %s failed %d\n", __func__, alloc->pid, vma->vm_start, vma->vm_end, |