Messages in this thread | | | From | Todd Kjos <> | Date | Tue, 19 Apr 2022 11:48:14 -0700 | Subject | Re: [PATCH v2 2/2] binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 |
| |
On Fri, Apr 15, 2022 at 5:00 AM Alessandro Astone <ales.astone@gmail.com> wrote: > > Some android userspace is sending BINDER_TYPE_FDA objects with > num_fds=0. Like the previous patch, this is reproducible when > playing a video. > > Before commit 09184ae9b575 BINDER_TYPE_FDA objects with num_fds=0 > were 'correctly handled', as in no fixup was performed. > > After commit 09184ae9b575 we aggregate fixup and skip regions in > binder_ptr_fixup structs and distinguish between the two by using > the skip_size field: if it's 0, then it's a fixup, otherwise skip. > When processing BINDER_TYPE_FDA objects with num_fds=0 we add a > skip region of skip_size=0, and this causes issues because now > binder_do_deferred_txn_copies will think this was a fixup region. > > To address that, return early from binder_translate_fd_array to > avoid adding an empty skip region. > > Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") > Signed-off-by: Alessandro Astone <ales.astone@gmail.com>
Acked-by: Todd Kjos <tkjos@google.com>
> --- > drivers/android/binder.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index 31176edb1069..f3b639e89dd8 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -2491,6 +2491,9 @@ static int binder_translate_fd_array(struct list_head *pf_head, > struct binder_proc *proc = thread->proc; > int ret; > > + if (fda->num_fds == 0) > + return 0; > + > fd_buf_size = sizeof(u32) * fda->num_fds; > if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { > binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n", > -- > 2.35.1 >
| |