evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "ANDROID: binder: Add strong ref checks"

Browse source
This commit is contained in:
Linux Build Service Account 2016-11-08 11:18:34 -08:00 • committed by Gerrit - the friendly Code Review server
commit b8335ae36f
1 changed files with 17 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/android/binder.c
View file

@ -1074,7 +1074,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
static struct binder_ref *binder_get_ref(struct binder_proc *proc, static struct binder_ref *binder_get_ref(struct binder_proc *proc,
uint32_t desc) uint32_t desc, bool need_strong_ref)
{ {
struct rb_node *n = proc->refs_by_desc.rb_node; struct rb_node *n = proc->refs_by_desc.rb_node;
struct binder_ref *ref; struct binder_ref *ref;
@ -1082,12 +1082,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
while (n) { while (n) {
ref = rb_entry(n, struct binder_ref, rb_node_desc); ref = rb_entry(n, struct binder_ref, rb_node_desc);
if (desc < ref->desc) if (desc < ref->desc) {
n = n->rb_left; n = n->rb_left;
else if (desc > ref->desc) } else if (desc > ref->desc) {
n = n->rb_right; n = n->rb_right;
else } else if (need_strong_ref && !ref->strong) {
binder_user_error("tried to use weak ref as strong ref\n");
return NULL;
} else {
return ref; return ref;
}
} }
return NULL; return NULL;
} }
@ -1357,7 +1361,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
} break; } break;
case BINDER_TYPE_HANDLE: case BINDER_TYPE_HANDLE:
case BINDER_TYPE_WEAK_HANDLE: { case BINDER_TYPE_WEAK_HANDLE: {
struct binder_ref *ref = binder_get_ref(proc, fp->handle); struct binder_ref *ref = binder_get_ref(proc, fp->handle,
fp->type == BINDER_TYPE_HANDLE);
if (ref == NULL) { if (ref == NULL) {
pr_err("transaction release %d bad handle %d\n", pr_err("transaction release %d bad handle %d\n",
@ -1452,7 +1457,7 @@ static void binder_transaction(struct binder_proc *proc,
if (tr->target.handle) { if (tr->target.handle) {
struct binder_ref *ref; struct binder_ref *ref;
ref = binder_get_ref(proc, tr->target.handle); ref = binder_get_ref(proc, tr->target.handle, true);
if (ref == NULL) { if (ref == NULL) {
binder_user_error("%d:%d got transaction to invalid handle\n", binder_user_error("%d:%d got transaction to invalid handle\n",
proc->pid, thread->pid); proc->pid, thread->pid);
@ -1661,7 +1666,8 @@ static void binder_transaction(struct binder_proc *proc,
} break; } break;
case BINDER_TYPE_HANDLE: case BINDER_TYPE_HANDLE:
case BINDER_TYPE_WEAK_HANDLE: { case BINDER_TYPE_WEAK_HANDLE: {
struct binder_ref *ref = binder_get_ref(proc, fp->handle); struct binder_ref *ref = binder_get_ref(proc, fp->handle,
fp->type == BINDER_TYPE_HANDLE);
if (ref == NULL) { if (ref == NULL) {
binder_user_error("%d:%d got transaction with invalid handle, %d\n", binder_user_error("%d:%d got transaction with invalid handle, %d\n",
@ -1880,7 +1886,9 @@ static int binder_thread_write(struct binder_proc *proc,
ref->desc); ref->desc);
} }
} else } else
ref = binder_get_ref(proc, target); ref = binder_get_ref(proc, target,
cmd == BC_ACQUIRE ||
cmd == BC_RELEASE);
if (ref == NULL) { if (ref == NULL) {
binder_user_error("%d:%d refcount change on invalid ref %d\n", binder_user_error("%d:%d refcount change on invalid ref %d\n",
proc->pid, thread->pid, target); proc->pid, thread->pid, target);
@ -2076,7 +2084,7 @@ static int binder_thread_write(struct binder_proc *proc,
if (get_user_preempt_disabled(cookie, (binder_uintptr_t __user *)ptr)) if (get_user_preempt_disabled(cookie, (binder_uintptr_t __user *)ptr))
return -EFAULT; return -EFAULT;
ptr += sizeof(binder_uintptr_t); ptr += sizeof(binder_uintptr_t);
ref = binder_get_ref(proc, target); ref = binder_get_ref(proc, target, false);
if (ref == NULL) { if (ref == NULL) {
binder_user_error("%d:%d %s invalid ref %d\n", binder_user_error("%d:%d %s invalid ref %d\n",
proc->pid, thread->pid, proc->pid, thread->pid,