On Tue, Mar 19, 2019 at 12:51 PM Todd Kjos <tkjos@xxxxxxxxxx> wrote: > Paul, > > I think this patch will fix it... can you run the selinux-testsuite > with the patch to verify? (the conditional assumed that size_t can go > negative) Building a test kernel now, I'll report back as soon as it is finished. Thanks. > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index 9a7c431469b3..bb9a661ffecc 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -2240,7 +2240,8 @@ static size_t binder_get_object(struct binder_proc *proc, > size_t object_size = 0; > > read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset); > - if (read_size < sizeof(*hdr) || !IS_ALIGNED(offset, sizeof(u32))) > + if (offset > buffer->data_size || read_size < sizeof(*hdr) || > + !IS_ALIGNED(offset, sizeof(u32))) > return 0; > binder_alloc_copy_from_buffer(&proc->alloc, object, buffer, > offset, read_size); > > On Mon, Mar 18, 2019 at 4:02 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > > > > On Mon, Mar 18, 2019 at 6:51 PM Todd Kjos <tkjos@xxxxxxxxxx> wrote: > > > On Mon, Mar 18, 2019 at 2:31 PM Paul Moore <paul@xxxxxxxxxxxxxx> wrote: > > > > Hello all. > > > > > > > > When running the selinux-testsuite (link below) against v5.1-rc1 I hit > > > > the BUG_ON() at the top of binder_alloc_do_buffer_copy() (trace > > > > below). I'm hoping this is a known issue with a fix already in the > > > > works? > > > > > > > > > Sadly, this is the first report of this, so no fix in flight. I'll try > > > to get a fix up in the next few days. > > > > No problem, thanks for letting me know. If you need some testing > > help, let me know. > > > > -- > > paul moore > > www.paul-moore.com -- paul moore www.paul-moore.com _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
