diff options
| author | Hridya Valsaraju <hridya@google.com> | 2019-09-04 13:07:04 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-09-04 13:17:35 +0200 |
| commit | 028fb5822b76bc2e095b5c145d7bd263878d9e27 (patch) | |
| tree | d9fb6b0bd85dd276d16a28769c3b9d4da226b2e3 /drivers/android | |
| parent | c165d8947bc41ebd3b0de3f520490cffb627af90 (diff) | |
| download | linux-028fb5822b76bc2e095b5c145d7bd263878d9e27.tar.gz linux-028fb5822b76bc2e095b5c145d7bd263878d9e27.tar.bz2 linux-028fb5822b76bc2e095b5c145d7bd263878d9e27.zip | |
binder: Validate the default binderfs device names.
Length of a binderfs device name cannot exceed BINDERFS_MAX_NAME.
This patch adds a check in binderfs_init() to ensure the same
for the default binder devices that will be created in every
binderfs instance.
Co-developed-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Reviewed-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Link: https://lore.kernel.org/r/20190808222727.132744-3-hridya@google.com
Link: https://lore.kernel.org/r/20190904110704.8606-3-christian.brauner@ubuntu.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android')
| -rw-r--r-- | drivers/android/binderfs.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/drivers/android/binderfs.c b/drivers/android/binderfs.c index e773f45d19d9..d8307cccbef8 100644 --- a/drivers/android/binderfs.c +++ b/drivers/android/binderfs.c @@ -553,6 +553,18 @@ static struct file_system_type binder_fs_type = { int __init init_binderfs(void) { int ret; + const char *name; + size_t len; + + /* Verify that the default binderfs device names are valid. */ + name = binder_devices_param; + for (len = strcspn(name, ","); len > 0; len = strcspn(name, ",")) { + if (len > BINDERFS_MAX_NAME) + return -E2BIG; + name += len; + if (*name == ',') + name++; + } /* Allocate new major number for binderfs. */ ret = alloc_chrdev_region(&binderfs_dev, 0, BINDERFS_MAX_MINOR, |