mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-01 14:44:12 +00:00
binder: Handle start==NULL in binder_update_page_range()
commit2a9edd056e
upstream. The old loop wouldn't stop when reaching `start` if `start==NULL`, instead continuing backwards to index -1 and crashing. Luckily you need to be highly privileged to map things at NULL, so it's not a big problem. Fix it by adjusting the loop so that the loop variable is always in bounds. This patch is deliberately minimal to simplify backporting, but IMO this function could use a refactor. The jump labels in the second loop body are horrible (the error gotos should be jumping to free_range instead), and both loops would look nicer if they just iterated upwards through indices. And the up_read()+mmput() shouldn't be duplicated like that. Cc: stable@vger.kernel.org Fixes:457b9a6f09
("Staging: android: add binder driver") Signed-off-by: Jann Horn <jannh@google.com> Acked-by: Christian Brauner <christian.brauner@ubuntu.com> Link: https://lore.kernel.org/r/20191018205631.248274-3-jannh@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
fe0d31eddb
commit
af0174a63c
1 changed files with 5 additions and 3 deletions
|
@ -295,8 +295,7 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
|
|||
return 0;
|
||||
|
||||
free_range:
|
||||
for (page_addr = end - PAGE_SIZE; page_addr >= start;
|
||||
page_addr -= PAGE_SIZE) {
|
||||
for (page_addr = end - PAGE_SIZE; 1; page_addr -= PAGE_SIZE) {
|
||||
bool ret;
|
||||
size_t index;
|
||||
|
||||
|
@ -309,6 +308,8 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
|
|||
WARN_ON(!ret);
|
||||
|
||||
trace_binder_free_lru_end(alloc, index);
|
||||
if (page_addr == start)
|
||||
break;
|
||||
continue;
|
||||
|
||||
err_vm_insert_page_failed:
|
||||
|
@ -318,7 +319,8 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
|
|||
page->page_ptr = NULL;
|
||||
err_alloc_page_failed:
|
||||
err_page_ptr_cleared:
|
||||
;
|
||||
if (page_addr == start)
|
||||
break;
|
||||
}
|
||||
err_no_vma:
|
||||
if (mm) {
|
||||
|
|
Loading…
Reference in a new issue