|
@@ -2217,7 +2217,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
|
|
|
debug_id, (u64)fda->num_fds);
|
|
|
continue;
|
|
|
}
|
|
|
- fd_array = (u32 *)(parent_buffer + fda->parent_offset);
|
|
|
+ fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
|
|
|
for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
|
|
|
task_close_fd(proc, fd_array[fd_index]);
|
|
|
} break;
|
|
@@ -2442,7 +2442,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
|
|
|
*/
|
|
|
parent_buffer = parent->buffer -
|
|
|
binder_alloc_get_user_buffer_offset(&target_proc->alloc);
|
|
|
- fd_array = (u32 *)(parent_buffer + fda->parent_offset);
|
|
|
+ fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
|
|
|
if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
|
|
|
binder_user_error("%d:%d parent offset not aligned correctly.\n",
|
|
|
proc->pid, thread->pid);
|
|
@@ -2508,7 +2508,7 @@ static int binder_fixup_parent(struct binder_transaction *t,
|
|
|
proc->pid, thread->pid);
|
|
|
return -EINVAL;
|
|
|
}
|
|
|
- parent_buffer = (u8 *)(parent->buffer -
|
|
|
+ parent_buffer = (u8 *)((uintptr_t)parent->buffer -
|
|
|
binder_alloc_get_user_buffer_offset(
|
|
|
&target_proc->alloc));
|
|
|
*(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
|