staging: android: binder: fix alignment issues

The Android userspace aligns the data written to the binder buffers to
4bytes. Thus for 32bit platforms or 64bit platforms running an 32bit
Android userspace we can have a buffer looking like this:

platform    buffer(binder_cmd   pointer)      size
32/32                 32b         32b          8B
64/32                 32b         64b          12B
64/64                 32b         64b          12B

Thus the kernel needs to check that the buffer size is aligned to 4bytes
not to (void *) that will be 8bytes on 64bit machines.

The change does not affect existing 32bit ABI.

Signed-off-by: Serban Constantinescu <serban.constantinescu@arm.com>
Acked-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 787fc921b1e7c88fa5376fc4b3ef87cd46e28e76..c6813ea15f403818fe96c28fede36ce385811dda 100644 (file)
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -1248,7 +1248,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                struct flat_binder_object *fp;
                if (*offp > buffer->data_size - sizeof(*fp) ||
                    buffer->data_size < sizeof(*fp) ||
-                   !IS_ALIGNED(*offp, sizeof(void *))) {
+                   !IS_ALIGNED(*offp, sizeof(u32))) {
                        pr_err("transaction release %d bad offset %zd, size %zd\n",
                         debug_id, *offp, buffer->data_size);
                        continue;
@@ -1497,7 +1497,7 @@ static void binder_transaction(struct binder_proc *proc,
                struct flat_binder_object *fp;
                if (*offp > t->buffer->data_size - sizeof(*fp) ||
                    t->buffer->data_size < sizeof(*fp) ||
-                   !IS_ALIGNED(*offp, sizeof(void *))) {
+                   !IS_ALIGNED(*offp, sizeof(u32))) {
                        binder_user_error("%d:%d got transaction with invalid offset, %zd\n",
                                        proc->pid, thread->pid, *offp);
                        return_error = BR_FAILED_REPLY;