kernel/drivers/android/binder_alloc.c, branch linux-5.1.y

binder: return errors from buffer copy functions

2019-07-14T06:09:51Z

commit bb4a2e48d5100ed3ff614df158a636bca3c6bf9f upstream. The buffer copy functions assumed the caller would ensure correct alignment and that the memory to be copied was completely within the binder buffer. There have been a few cases discovered by syzkallar where a malformed transaction created by a user could violated the assumptions and resulted in a BUG_ON. The fix is to remove the BUG_ON and always return the error to be handled appropriately by the caller. Acked-by: Martijn Coenen Reported-by: syzbot+3ae18325f96190606754@syzkaller.appspotmail.com Fixes: bde4a19fc04f ("binder: use userspace pointer as base of buffer space") Suggested-by: Dan Carpenter Signed-off-by: Todd Kjos Cc: stable Signed-off-by: Greg Kroah-Hartman

binder: fix race between munmap() and direct reclaim

2019-03-21T05:51:32Z

An munmap() on a binder device causes binder_vma_close() to be called which clears the alloc->vma pointer. If direct reclaim causes binder_alloc_free_page() to be called, there is a race where alloc->vma is read into a local vma pointer and then used later after the mm->mmap_sem is acquired. This can result in calling zap_page_range() with an invalid vma which manifests as a use-after-free in zap_page_range(). The fix is to check alloc->vma after acquiring the mmap_sem (which we were acquiring anyway) and skip zap_page_range() if it has changed to NULL. Signed-off-by: Todd Kjos Reviewed-by: Joel Fernandes (Google) Cc: stable Signed-off-by: Greg Kroah-Hartman

binder: reduce mmap_sem write-side lock

2019-02-19T13:50:11Z

binder has used write-side mmap_sem semaphore to release memory mapped at address space of the process. However, right lock to release pages is down_read, not down_write because page table lock already protects the race for parallel freeing. Please do not use mmap_sem write-side lock which is well known contented lock. Cc: Todd Kjos Cc: Martijn Coenen Cc: Arve Hjønnevåg Signed-off-by: Minchan Kim Signed-off-by: Greg Kroah-Hartman

binder: use userspace pointer as base of buffer space

2019-02-12T09:43:57Z

Now that alloc->buffer points to the userspace vm_area rename buffer->data to buffer->user_data and rename local pointers that hold user addresses. Also use the "__user" tag to annotate all user pointers so sparse can flag cases where user pointer vaues are copied to kernel pointers. Refactor code to use offsets instead of user pointers. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman

binder: remove user_buffer_offset

2019-02-12T09:43:57Z

Remove user_buffer_offset since there is no kernel buffer pointer anymore. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman

binder: remove kernel vm_area for buffer space

2019-02-12T09:43:57Z

Remove the kernel's vm_area and the code that maps buffer pages into it. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman

binder: add functions to copy to/from binder buffers

2019-02-12T09:43:57Z

Avoid vm_area when copying to or from binder buffers. Instead, new copy functions are added that copy from kernel space to binder buffer space. These use kmap_atomic() and kunmap_atomic() to create temporary mappings and then memcpy() is used to copy within that page. Also, kmap_atomic() / kunmap_atomic() use the appropriate cache flushing to support VIVT cache architectures. Allow binder to build if CPU_CACHE_VIVT is defined. Several uses of the new functions are added here. More to follow in subsequent patches. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman

binder: create userspace-to-binder-buffer copy function

2019-02-12T09:43:57Z

The binder driver uses a vm_area to map the per-process binder buffer space. For 32-bit android devices, this is now taking too much vmalloc space. This patch removes the use of vm_area when copying the transaction data from the sender to the buffer space. Instead of using copy_from_user() for multi-page copies, it now uses binder_alloc_copy_user_to_buffer() which uses kmap() and kunmap() to map each page, and uses copy_from_user() for copying to that page. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman

Merge 4.20-rc5 into char-misc-next

2018-12-03T06:56:15Z

We need the fixes in here as well. Signed-off-by: Greg Kroah-Hartman

binder: fix sparse warnings on locking context

2018-11-26T19:12:05Z

Add __acquire()/__release() annnotations to fix warnings in sparse context checking There is one case where the warning was due to a lack of a "default:" case in a switch statement where a lock was being released in each of the cases, so the default case was added. Signed-off-by: Todd Kjos Signed-off-by: Greg Kroah-Hartman