|
@@ -1248,7 +1248,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
|
|
|
struct flat_binder_object *fp;
|
|
|
if (*offp > buffer->data_size - sizeof(*fp) ||
|
|
|
buffer->data_size < sizeof(*fp) ||
|
|
|
- !IS_ALIGNED(*offp, sizeof(void *))) {
|
|
|
+ !IS_ALIGNED(*offp, sizeof(u32))) {
|
|
|
pr_err("transaction release %d bad offset %zd, size %zd\n",
|
|
|
debug_id, *offp, buffer->data_size);
|
|
|
continue;
|
|
@@ -1497,7 +1497,7 @@ static void binder_transaction(struct binder_proc *proc,
|
|
|
struct flat_binder_object *fp;
|
|
|
if (*offp > t->buffer->data_size - sizeof(*fp) ||
|
|
|
t->buffer->data_size < sizeof(*fp) ||
|
|
|
- !IS_ALIGNED(*offp, sizeof(void *))) {
|
|
|
+ !IS_ALIGNED(*offp, sizeof(u32))) {
|
|
|
binder_user_error("%d:%d got transaction with invalid offset, %zd\n",
|
|
|
proc->pid, thread->pid, *offp);
|
|
|
return_error = BR_FAILED_REPLY;
|