From: Dan Carpenter Date: Thu, 29 Mar 2018 09:14:40 +0000 (+0300) Subject: UPSTREAM: ANDROID: binder: re-order some conditions X-Git-Tag: khadas-vims-v0.9.6-release~1584^2~10 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=a199689541db907b2d256b48e51d8c2ed96e96ca;p=platform%2Fkernel%2Flinux-amlogic.git UPSTREAM: ANDROID: binder: re-order some conditions It doesn't make any difference to runtime but I've switched these two checks to make my static checker happy. The problem is that "buffer->data_size" is user controlled and if it's less than "sizeo(*hdr)" then that means "offset" can be more than "buffer->data_size". It's just cleaner to check it in the other order. Signed-off-by: Dan Carpenter Acked-by: Martijn Coenen Signed-off-by: Greg Kroah-Hartman (cherry picked from commit 361f2ddbb0c9f9b4f336025a7bd0212cea4a34f0) Change-Id: I098d525ba63d125caa9840e6e1d5004bf70edc3c --- diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 5ddbe9c..754a320 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2214,8 +2214,8 @@ static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset) struct binder_object_header *hdr; size_t object_size = 0; - if (offset > buffer->data_size - sizeof(*hdr) || - buffer->data_size < sizeof(*hdr) || + if (buffer->data_size < sizeof(*hdr) || + offset > buffer->data_size - sizeof(*hdr) || !IS_ALIGNED(offset, sizeof(u32))) return 0;