diff options
| -rw-r--r-- | drivers/staging/android/binder.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c index 787fc921b1e7..c6813ea15f40 100644 --- a/drivers/staging/android/binder.c +++ b/drivers/staging/android/binder.c @@ -1248,7 +1248,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, struct flat_binder_object *fp; if (*offp > buffer->data_size - sizeof(*fp) || buffer->data_size < sizeof(*fp) || - !IS_ALIGNED(*offp, sizeof(void *))) { + !IS_ALIGNED(*offp, sizeof(u32))) { pr_err("transaction release %d bad offset %zd, size %zd\n", debug_id, *offp, buffer->data_size); continue; @@ -1497,7 +1497,7 @@ static void binder_transaction(struct binder_proc *proc, struct flat_binder_object *fp; if (*offp > t->buffer->data_size - sizeof(*fp) || t->buffer->data_size < sizeof(*fp) || - !IS_ALIGNED(*offp, sizeof(void *))) { + !IS_ALIGNED(*offp, sizeof(u32))) { binder_user_error("%d:%d got transaction with invalid offset, %zd\n", proc->pid, thread->pid, *offp); return_error = BR_FAILED_REPLY; |