1 files changed, 22 insertions, 7 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 01f80cbd2741..5ddb2a4d893e 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3078,8 +3078,12 @@ static void binder_transaction(struct binder_proc *proc,
                                       ALIGN(tr->data_size, sizeof(void *)));
         offp = off_start;
 
-        if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
-                           tr->data.ptr.buffer, tr->data_size)) {
+        if (binder_alloc_copy_user_to_buffer(
+                                &target_proc->alloc,
+                                t->buffer, 0,
+                                (const void __user *)
+                                        (uintptr_t)tr->data.ptr.buffer,
+                                tr->data_size)) {
                 binder_user_error("%d:%d got transaction with invalid data ptr\n",
                                 proc->pid, thread->pid);
                 return_error = BR_FAILED_REPLY;
@@ -3087,8 +3091,13 @@ static void binder_transaction(struct binder_proc *proc,
                 return_error_line = __LINE__;
                 goto err_copy_data_failed;
         }
-        if (copy_from_user(offp, (const void __user *)(uintptr_t)
-                           tr->data.ptr.offsets, tr->offsets_size)) {
+        if (binder_alloc_copy_user_to_buffer(
+                                &target_proc->alloc,
+                                t->buffer,
+                                ALIGN(tr->data_size, sizeof(void *)),
+                                (const void __user *)
+                                        (uintptr_t)tr->data.ptr.offsets,
+                                tr->offsets_size)) {
                 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
                                 proc->pid, thread->pid);
                 return_error = BR_FAILED_REPLY;
@@ -3217,6 +3226,8 @@ static void binder_transaction(struct binder_proc *proc,
                         struct binder_buffer_object *bp =
                                 to_binder_buffer_object(hdr);
                         size_t buf_left = sg_buf_end - sg_bufp;
+                        binder_size_t sg_buf_offset = (uintptr_t)sg_bufp -
+                                (uintptr_t)t->buffer->data;
 
                         if (bp->length > buf_left) {
                                 binder_user_error("%d:%d got transaction with too large buffer\n",
@@ -3226,9 +3237,13 @@ static void binder_transaction(struct binder_proc *proc,
                                 return_error_line = __LINE__;
                                 goto err_bad_offset;
                         }
-                        if (copy_from_user(sg_bufp,
-                                           (const void __user *)(uintptr_t)
-                                           bp->buffer, bp->length)) {
+                        if (binder_alloc_copy_user_to_buffer(
+                                                &target_proc->alloc,
+                                                t->buffer,
+                                                sg_buf_offset,
+                                                (const void __user *)
+                                                        (uintptr_t)bp->buffer,
+                                                bp->length)) {
                                 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
                                                   proc->pid, thread->pid);
                                 return_error_param = -EFAULT;