On Tue, Jun 18, 2019 at 5:18 AM Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote: > > It's weird that that binder_alloc_copy_from_buffer() is a void function. > It would be easier to do the error handling at that point, instead of in > the callers. It feels like we keep hitting similar bugs to this. The idea is that if it is an error that the user can cause, it is checked by the caller of binder_alloc_copy_from_buffer(). Most uses are kernel cases where the expected alignments should be fine and it's a BUG if they are not. Admittedly, a few cases (like this one) have slipped through since they cannot happen in Android (syzkaller has been very useful to find our bad assumptions). -Todd > > regards, > dan carpenter > _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
