Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1530040

[PATCH 3.12 014/127] ANDROID: binder: Add strong ref checks

From Jiri Slaby <jslaby@suse.cz>
Newsgroups linux.kernel
Subject [PATCH 3.12 014/127] ANDROID: binder: Add strong ref checks
Date 2016-11-25 10:20 +0100
Message-ID <sHkPM-78Y-29@gated-at.bofh.it> (permalink)
References <sHkd3-6Ft-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

From: Arve Hjønnevåg <arve@android.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 0a3ffab93fe52530602fe47cd74802cffdb19c05 upstream.

Prevent using a binder_ref with only weak references where a strong
reference is required.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 drivers/staging/android/binder.c | 30 +++++++++++++++++++++---------
 1 file changed, 21 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 69fd236345cb..8a436dae9b77 100644
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -994,7 +994,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
 
 
 static struct binder_ref *binder_get_ref(struct binder_proc *proc,
-					 uint32_t desc)
+					 u32 desc, bool need_strong_ref)
 {
 	struct rb_node *n = proc->refs_by_desc.rb_node;
 	struct binder_ref *ref;
@@ -1002,12 +1002,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
 	while (n) {
 		ref = rb_entry(n, struct binder_ref, rb_node_desc);
 
-		if (desc < ref->desc)
+		if (desc < ref->desc) {
 			n = n->rb_left;
-		else if (desc > ref->desc)
+		} else if (desc > ref->desc) {
 			n = n->rb_right;
-		else
+		} else if (need_strong_ref && !ref->strong) {
+			binder_user_error("tried to use weak ref as strong ref\n");
+			return NULL;
+		} else {
 			return ref;
+		}
 	}
 	return NULL;
 }
@@ -1270,7 +1274,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
 		} break;
 		case BINDER_TYPE_HANDLE:
 		case BINDER_TYPE_WEAK_HANDLE: {
-			struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+			struct binder_ref *ref;
+
+			ref = binder_get_ref(proc, fp->handle,
+					     fp->type == BINDER_TYPE_HANDLE);
 			if (ref == NULL) {
 				pr_err("transaction release %d bad handle %d\n",
 				 debug_id, fp->handle);
@@ -1362,7 +1369,7 @@ static void binder_transaction(struct binder_proc *proc,
 	} else {
 		if (tr->target.handle) {
 			struct binder_ref *ref;
-			ref = binder_get_ref(proc, tr->target.handle);
+			ref = binder_get_ref(proc, tr->target.handle, true);
 			if (ref == NULL) {
 				binder_user_error("%d:%d got transaction to invalid handle\n",
 					proc->pid, thread->pid);
@@ -1546,7 +1553,10 @@ static void binder_transaction(struct binder_proc *proc,
 		} break;
 		case BINDER_TYPE_HANDLE:
 		case BINDER_TYPE_WEAK_HANDLE: {
-			struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+			struct binder_ref *ref;
+
+			ref = binder_get_ref(proc, fp->handle,
+					     fp->type == BINDER_TYPE_HANDLE);
 			if (ref == NULL) {
 				binder_user_error("%d:%d got transaction with invalid handle, %d\n",
 						proc->pid,
@@ -1739,7 +1749,9 @@ int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
 						ref->desc);
 				}
 			} else
-				ref = binder_get_ref(proc, target);
+				ref = binder_get_ref(proc, target,
+						     cmd == BC_ACQUIRE ||
+						     cmd == BC_RELEASE);
 			if (ref == NULL) {
 				binder_user_error("%d:%d refcount change on invalid ref %d\n",
 					proc->pid, thread->pid, target);
@@ -1934,7 +1946,7 @@ int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
 			if (get_user(cookie, (void __user * __user *)ptr))
 				return -EFAULT;
 			ptr += sizeof(void *);
-			ref = binder_get_ref(proc, target);
+			ref = binder_get_ref(proc, target, false);
 			if (ref == NULL) {
 				binder_user_error("%d:%d %s invalid ref %d\n",
 					proc->pid, thread->pid,
-- 
2.10.2

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 001/127] Revert "KVM: MIPS: Drop other CPU ASIDs on guest MMU changes" Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 045/127] UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC header Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 037/127] scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 019/127] USB: serial: fix potential NULL-dereference at probe Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 043/127] drm/exynos: fix error handling in exynos_drm_subdrv_open Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 035/127] scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 041/127] x86/xen: fix upper bound of pmd loop in xen_cleanhighmap() Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 039/127] drm/radeon/si_dpm: workaround for SI kickers Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 022/127] vt: clear selection before resizing Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 034/127] mac80211: discard multicast and 4-addr A-MSDUs Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 015/127] ANDROID: binder: Clear binder and cookie when setting handle in flat binder struct Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 023/127] hv: do not lose pending heartbeat vmbus packets Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 021/127] Fix potential infoleak in older kernels Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 016/127] ubifs: Abort readdir upon error Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 055/127] coredump: fix unfreezable coredumping task Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 013/127] ALSA: hda - Merge RIRB_PRE_DELAY into CTX_WORKAROUND caps Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 033/127] firewire: net: fix fragmented datagram_size off-by-one Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 030/127] virtio: console: Unlock vqs while freeing buffers Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 018/127] usb: gadget: function: u_ether: don't starve tx request queue Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 029/127] parisc: Ensure consistent state when switching to kernel stack at syscall entry Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 040/127] drm/radeon: drop register readback in cayman_cp_int_cntl_setup Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 036/127] scsi: scsi_debug: Fix memory leak if LBP enabled and module is unloaded Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 020/127] USB: serial: ftdi_sio: add support for Infineon TriBoard TC2X7 Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:10 +0100
  [PATCH 3.12 012/127] ALSA: usb-audio: Add quirk for Syntek STK1160 Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 009/127] HID: usbhid: Add HID_QUIRK_NOGET for Aten DVI KVM switch Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 011/127] KEYS: Fix short sprintf buffer in /proc/keys show function Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 010/127] libxfs: clean up _calc_dquots_per_chunk Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 005/127] HID: input: add mic mute key on HP slim keyboard Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 008/127] UBIFS: Fix possible memory leak in ubifs_readdir() Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 007/127] tty: Prevent ldisc drivers from re-using stale tty fields Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 014/127] ANDROID: binder: Add strong ref checks Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 004/127] KVM: MIPS: Precalculate MMIO load resume PC Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100
  [PATCH 3.12 006/127] HID: microsoft: Add Surface 4 type cover pro 4 (JP) Jiri Slaby <jslaby@suse.cz> - 2016-11-25 10:20 +0100

csiph-web