summaryrefslogtreecommitdiff
path: root/drivers/android
diff options
context:
space:
mode:
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>2022-05-02 14:49:24 +0300
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2022-05-02 14:49:24 +0300
commit35a7609639c49f76f13f206402cbf692c4ae3e4e (patch)
tree55c8cf59f8bac0754eff06a3f102d2d819dc39ed /drivers/android
parente918c10265ef2bc82ce8a6fed6d8123d09ec1db3 (diff)
parent672c0c5173427e6b3e2a9bbb7be51ceeec78093a (diff)
downloadlinux-35a7609639c49f76f13f206402cbf692c4ae3e4e.tar.xz
Merge 5.18-rc5 into char-misc-next
We need the char-misc fixes in here as well. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android')
-rw-r--r--drivers/android/binder.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index bfadc0c4a442..5ffdad274301 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -2298,6 +2298,7 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
{
int ret = 0;
struct binder_sg_copy *sgc, *tmpsgc;
+ struct binder_ptr_fixup *tmppf;
struct binder_ptr_fixup *pf =
list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
node);
@@ -2352,7 +2353,11 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
list_del(&sgc->node);
kfree(sgc);
}
- BUG_ON(!list_empty(pf_head));
+ list_for_each_entry_safe(pf, tmppf, pf_head, node) {
+ BUG_ON(pf->skip_size == 0);
+ list_del(&pf->node);
+ kfree(pf);
+ }
BUG_ON(!list_empty(sgc_head));
return ret > 0 ? -EINVAL : ret;
@@ -2489,6 +2494,9 @@ static int binder_translate_fd_array(struct list_head *pf_head,
struct binder_proc *proc = thread->proc;
int ret;
+ if (fda->num_fds == 0)
+ return 0;
+
fd_buf_size = sizeof(u32) * fda->num_fds;
if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",