Alessandro Astone 62f8c07d84 binder: Address corner cases in deferred copy and fixup ... commit 2d1746e3fd upstream. When handling BINDER_TYPE_FDA object we are pushing a parent fixup with a certain skip_size but no scatter-gather copy object, since the copy is handled standalone. If BINDER_TYPE_FDA is the last children the scatter-gather copy loop will never stop to skip it, thus we are left with an item in the parent fixup list. This will trigger the BUG_ON(). This is reproducible in android when playing a video. We receive a transaction that looks like this: obj[0] BINDER_TYPE_PTR, parent obj[1] BINDER_TYPE_PTR, child obj[2] BINDER_TYPE_PTR, child obj[3] BINDER_TYPE_FDA, child Fixes: 09184ae9b5 ("binder: defer copies of pre-patched txn data") Acked-by: Todd Kjos <tkjos@google.com> Cc: stable <stable@kernel.org> Signed-off-by: Alessandro Astone <ales.astone@gmail.com> Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-05-09 09:16:14 +02:00
..
binder.c	binder: Address corner cases in deferred copy and fixup	2022-05-09 09:16:14 +02:00
binder_alloc.c	binder: fix async_free_space accounting for empty parcels	2021-12-21 11:07:34 +01:00
binder_alloc.h	binder: tell userspace to dump current backtrace when detected oneway spamming	2021-04-10 10:52:04 +02:00
binder_alloc_selftest.c	binder: print warnings when detecting oneway spamming.	2020-09-03 18:24:41 +02:00
binder_internal.h	selinux/stable-5.16 PR 20211101	2021-11-01 21:06:18 -07:00
binder_trace.h	binder: add trace at free transaction.	2020-11-11 08:20:44 +01:00
binderfs.c	binderfs: add support for feature files	2021-07-21 13:46:36 +02:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00