1 // SPDX-License-Identifier: GPL-2.0-only 2 /* binder.c 3 * 4 * Android IPC Subsystem 5 * 6 * Copyright (C) 2007-2008 Google, Inc. 7 */ 8 9 /* 10 * Locking overview 11 * 12 * There are 3 main spinlocks which must be acquired in the 13 * order shown: 14 * 15 * 1) proc->outer_lock : protects binder_ref 16 * binder_proc_lock() and binder_proc_unlock() are 17 * used to acq/rel. 18 * 2) node->lock : protects most fields of binder_node. 19 * binder_node_lock() and binder_node_unlock() are 20 * used to acq/rel 21 * 3) proc->inner_lock : protects the thread and node lists 22 * (proc->threads, proc->waiting_threads, proc->nodes) 23 * and all todo lists associated with the binder_proc 24 * (proc->todo, thread->todo, proc->delivered_death and 25 * node->async_todo), as well as thread->transaction_stack 26 * binder_inner_proc_lock() and binder_inner_proc_unlock() 27 * are used to acq/rel 28 * 29 * Any lock under procA must never be nested under any lock at the same 30 * level or below on procB. 31 * 32 * Functions that require a lock held on entry indicate which lock 33 * in the suffix of the function name: 34 * 35 * foo_olocked() : requires node->outer_lock 36 * foo_nlocked() : requires node->lock 37 * foo_ilocked() : requires proc->inner_lock 38 * foo_oilocked(): requires proc->outer_lock and proc->inner_lock 39 * foo_nilocked(): requires node->lock and proc->inner_lock 40 * ... 41 */ 42 43 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 44 45 #include <linux/fdtable.h> 46 #include <linux/file.h> 47 #include <linux/freezer.h> 48 #include <linux/fs.h> 49 #include <linux/list.h> 50 #include <linux/miscdevice.h> 51 #include <linux/module.h> 52 #include <linux/mutex.h> 53 #include <linux/nsproxy.h> 54 #include <linux/poll.h> 55 #include <linux/debugfs.h> 56 #include <linux/rbtree.h> 57 #include <linux/sched/signal.h> 58 #include <linux/sched/mm.h> 59 #include <linux/seq_file.h> 60 #include <linux/string.h> 61 #include <linux/uaccess.h> 62 #include <linux/pid_namespace.h> 63 #include <linux/security.h> 64 #include <linux/spinlock.h> 65 #include <linux/ratelimit.h> 66 #include <linux/syscalls.h> 67 #include <linux/task_work.h> 68 #include <linux/sizes.h> 69 70 #include <uapi/linux/android/binder.h> 71 72 #include <linux/cacheflush.h> 73 74 #include "binder_internal.h" 75 #include "binder_trace.h" 76 77 static HLIST_HEAD(binder_deferred_list); 78 static DEFINE_MUTEX(binder_deferred_lock); 79 80 static HLIST_HEAD(binder_devices); 81 static HLIST_HEAD(binder_procs); 82 static DEFINE_MUTEX(binder_procs_lock); 83 84 static HLIST_HEAD(binder_dead_nodes); 85 static DEFINE_SPINLOCK(binder_dead_nodes_lock); 86 87 static struct dentry *binder_debugfs_dir_entry_root; 88 static struct dentry *binder_debugfs_dir_entry_proc; 89 static atomic_t binder_last_id; 90 91 static int proc_show(struct seq_file *m, void *unused); 92 DEFINE_SHOW_ATTRIBUTE(proc); 93 94 #define FORBIDDEN_MMAP_FLAGS (VM_WRITE) 95 96 enum { 97 BINDER_DEBUG_USER_ERROR = 1U << 0, 98 BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1, 99 BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2, 100 BINDER_DEBUG_OPEN_CLOSE = 1U << 3, 101 BINDER_DEBUG_DEAD_BINDER = 1U << 4, 102 BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5, 103 BINDER_DEBUG_READ_WRITE = 1U << 6, 104 BINDER_DEBUG_USER_REFS = 1U << 7, 105 BINDER_DEBUG_THREADS = 1U << 8, 106 BINDER_DEBUG_TRANSACTION = 1U << 9, 107 BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10, 108 BINDER_DEBUG_FREE_BUFFER = 1U << 11, 109 BINDER_DEBUG_INTERNAL_REFS = 1U << 12, 110 BINDER_DEBUG_PRIORITY_CAP = 1U << 13, 111 BINDER_DEBUG_SPINLOCKS = 1U << 14, 112 }; 113 static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR | 114 BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION; 115 module_param_named(debug_mask, binder_debug_mask, uint, 0644); 116 117 char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES; 118 module_param_named(devices, binder_devices_param, charp, 0444); 119 120 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait); 121 static int binder_stop_on_user_error; 122 123 static int binder_set_stop_on_user_error(const char *val, 124 const struct kernel_param *kp) 125 { 126 int ret; 127 128 ret = param_set_int(val, kp); 129 if (binder_stop_on_user_error < 2) 130 wake_up(&binder_user_error_wait); 131 return ret; 132 } 133 module_param_call(stop_on_user_error, binder_set_stop_on_user_error, 134 param_get_int, &binder_stop_on_user_error, 0644); 135 136 #define binder_debug(mask, x...) \ 137 do { \ 138 if (binder_debug_mask & mask) \ 139 pr_info_ratelimited(x); \ 140 } while (0) 141 142 #define binder_user_error(x...) \ 143 do { \ 144 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \ 145 pr_info_ratelimited(x); \ 146 if (binder_stop_on_user_error) \ 147 binder_stop_on_user_error = 2; \ 148 } while (0) 149 150 #define to_flat_binder_object(hdr) \ 151 container_of(hdr, struct flat_binder_object, hdr) 152 153 #define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr) 154 155 #define to_binder_buffer_object(hdr) \ 156 container_of(hdr, struct binder_buffer_object, hdr) 157 158 #define to_binder_fd_array_object(hdr) \ 159 container_of(hdr, struct binder_fd_array_object, hdr) 160 161 static struct binder_stats binder_stats; 162 163 static inline void binder_stats_deleted(enum binder_stat_types type) 164 { 165 atomic_inc(&binder_stats.obj_deleted[type]); 166 } 167 168 static inline void binder_stats_created(enum binder_stat_types type) 169 { 170 atomic_inc(&binder_stats.obj_created[type]); 171 } 172 173 struct binder_transaction_log binder_transaction_log; 174 struct binder_transaction_log binder_transaction_log_failed; 175 176 static struct binder_transaction_log_entry *binder_transaction_log_add( 177 struct binder_transaction_log *log) 178 { 179 struct binder_transaction_log_entry *e; 180 unsigned int cur = atomic_inc_return(&log->cur); 181 182 if (cur >= ARRAY_SIZE(log->entry)) 183 log->full = true; 184 e = &log->entry[cur % ARRAY_SIZE(log->entry)]; 185 WRITE_ONCE(e->debug_id_done, 0); 186 /* 187 * write-barrier to synchronize access to e->debug_id_done. 188 * We make sure the initialized 0 value is seen before 189 * memset() other fields are zeroed by memset. 190 */ 191 smp_wmb(); 192 memset(e, 0, sizeof(*e)); 193 return e; 194 } 195 196 enum binder_deferred_state { 197 BINDER_DEFERRED_FLUSH = 0x01, 198 BINDER_DEFERRED_RELEASE = 0x02, 199 }; 200 201 enum { 202 BINDER_LOOPER_STATE_REGISTERED = 0x01, 203 BINDER_LOOPER_STATE_ENTERED = 0x02, 204 BINDER_LOOPER_STATE_EXITED = 0x04, 205 BINDER_LOOPER_STATE_INVALID = 0x08, 206 BINDER_LOOPER_STATE_WAITING = 0x10, 207 BINDER_LOOPER_STATE_POLL = 0x20, 208 }; 209 210 /** 211 * binder_proc_lock() - Acquire outer lock for given binder_proc 212 * @proc: struct binder_proc to acquire 213 * 214 * Acquires proc->outer_lock. Used to protect binder_ref 215 * structures associated with the given proc. 216 */ 217 #define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__) 218 static void 219 _binder_proc_lock(struct binder_proc *proc, int line) 220 __acquires(&proc->outer_lock) 221 { 222 binder_debug(BINDER_DEBUG_SPINLOCKS, 223 "%s: line=%d\n", __func__, line); 224 spin_lock(&proc->outer_lock); 225 } 226 227 /** 228 * binder_proc_unlock() - Release spinlock for given binder_proc 229 * @proc: struct binder_proc to acquire 230 * 231 * Release lock acquired via binder_proc_lock() 232 */ 233 #define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__) 234 static void 235 _binder_proc_unlock(struct binder_proc *proc, int line) 236 __releases(&proc->outer_lock) 237 { 238 binder_debug(BINDER_DEBUG_SPINLOCKS, 239 "%s: line=%d\n", __func__, line); 240 spin_unlock(&proc->outer_lock); 241 } 242 243 /** 244 * binder_inner_proc_lock() - Acquire inner lock for given binder_proc 245 * @proc: struct binder_proc to acquire 246 * 247 * Acquires proc->inner_lock. Used to protect todo lists 248 */ 249 #define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__) 250 static void 251 _binder_inner_proc_lock(struct binder_proc *proc, int line) 252 __acquires(&proc->inner_lock) 253 { 254 binder_debug(BINDER_DEBUG_SPINLOCKS, 255 "%s: line=%d\n", __func__, line); 256 spin_lock(&proc->inner_lock); 257 } 258 259 /** 260 * binder_inner_proc_unlock() - Release inner lock for given binder_proc 261 * @proc: struct binder_proc to acquire 262 * 263 * Release lock acquired via binder_inner_proc_lock() 264 */ 265 #define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__) 266 static void 267 _binder_inner_proc_unlock(struct binder_proc *proc, int line) 268 __releases(&proc->inner_lock) 269 { 270 binder_debug(BINDER_DEBUG_SPINLOCKS, 271 "%s: line=%d\n", __func__, line); 272 spin_unlock(&proc->inner_lock); 273 } 274 275 /** 276 * binder_node_lock() - Acquire spinlock for given binder_node 277 * @node: struct binder_node to acquire 278 * 279 * Acquires node->lock. Used to protect binder_node fields 280 */ 281 #define binder_node_lock(node) _binder_node_lock(node, __LINE__) 282 static void 283 _binder_node_lock(struct binder_node *node, int line) 284 __acquires(&node->lock) 285 { 286 binder_debug(BINDER_DEBUG_SPINLOCKS, 287 "%s: line=%d\n", __func__, line); 288 spin_lock(&node->lock); 289 } 290 291 /** 292 * binder_node_unlock() - Release spinlock for given binder_proc 293 * @node: struct binder_node to acquire 294 * 295 * Release lock acquired via binder_node_lock() 296 */ 297 #define binder_node_unlock(node) _binder_node_unlock(node, __LINE__) 298 static void 299 _binder_node_unlock(struct binder_node *node, int line) 300 __releases(&node->lock) 301 { 302 binder_debug(BINDER_DEBUG_SPINLOCKS, 303 "%s: line=%d\n", __func__, line); 304 spin_unlock(&node->lock); 305 } 306 307 /** 308 * binder_node_inner_lock() - Acquire node and inner locks 309 * @node: struct binder_node to acquire 310 * 311 * Acquires node->lock. If node->proc also acquires 312 * proc->inner_lock. Used to protect binder_node fields 313 */ 314 #define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__) 315 static void 316 _binder_node_inner_lock(struct binder_node *node, int line) 317 __acquires(&node->lock) __acquires(&node->proc->inner_lock) 318 { 319 binder_debug(BINDER_DEBUG_SPINLOCKS, 320 "%s: line=%d\n", __func__, line); 321 spin_lock(&node->lock); 322 if (node->proc) 323 binder_inner_proc_lock(node->proc); 324 else 325 /* annotation for sparse */ 326 __acquire(&node->proc->inner_lock); 327 } 328 329 /** 330 * binder_node_unlock() - Release node and inner locks 331 * @node: struct binder_node to acquire 332 * 333 * Release lock acquired via binder_node_lock() 334 */ 335 #define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__) 336 static void 337 _binder_node_inner_unlock(struct binder_node *node, int line) 338 __releases(&node->lock) __releases(&node->proc->inner_lock) 339 { 340 struct binder_proc *proc = node->proc; 341 342 binder_debug(BINDER_DEBUG_SPINLOCKS, 343 "%s: line=%d\n", __func__, line); 344 if (proc) 345 binder_inner_proc_unlock(proc); 346 else 347 /* annotation for sparse */ 348 __release(&node->proc->inner_lock); 349 spin_unlock(&node->lock); 350 } 351 352 static bool binder_worklist_empty_ilocked(struct list_head *list) 353 { 354 return list_empty(list); 355 } 356 357 /** 358 * binder_worklist_empty() - Check if no items on the work list 359 * @proc: binder_proc associated with list 360 * @list: list to check 361 * 362 * Return: true if there are no items on list, else false 363 */ 364 static bool binder_worklist_empty(struct binder_proc *proc, 365 struct list_head *list) 366 { 367 bool ret; 368 369 binder_inner_proc_lock(proc); 370 ret = binder_worklist_empty_ilocked(list); 371 binder_inner_proc_unlock(proc); 372 return ret; 373 } 374 375 /** 376 * binder_enqueue_work_ilocked() - Add an item to the work list 377 * @work: struct binder_work to add to list 378 * @target_list: list to add work to 379 * 380 * Adds the work to the specified list. Asserts that work 381 * is not already on a list. 382 * 383 * Requires the proc->inner_lock to be held. 384 */ 385 static void 386 binder_enqueue_work_ilocked(struct binder_work *work, 387 struct list_head *target_list) 388 { 389 BUG_ON(target_list == NULL); 390 BUG_ON(work->entry.next && !list_empty(&work->entry)); 391 list_add_tail(&work->entry, target_list); 392 } 393 394 /** 395 * binder_enqueue_deferred_thread_work_ilocked() - Add deferred thread work 396 * @thread: thread to queue work to 397 * @work: struct binder_work to add to list 398 * 399 * Adds the work to the todo list of the thread. Doesn't set the process_todo 400 * flag, which means that (if it wasn't already set) the thread will go to 401 * sleep without handling this work when it calls read. 402 * 403 * Requires the proc->inner_lock to be held. 404 */ 405 static void 406 binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread, 407 struct binder_work *work) 408 { 409 WARN_ON(!list_empty(&thread->waiting_thread_node)); 410 binder_enqueue_work_ilocked(work, &thread->todo); 411 } 412 413 /** 414 * binder_enqueue_thread_work_ilocked() - Add an item to the thread work list 415 * @thread: thread to queue work to 416 * @work: struct binder_work to add to list 417 * 418 * Adds the work to the todo list of the thread, and enables processing 419 * of the todo queue. 420 * 421 * Requires the proc->inner_lock to be held. 422 */ 423 static void 424 binder_enqueue_thread_work_ilocked(struct binder_thread *thread, 425 struct binder_work *work) 426 { 427 WARN_ON(!list_empty(&thread->waiting_thread_node)); 428 binder_enqueue_work_ilocked(work, &thread->todo); 429 thread->process_todo = true; 430 } 431 432 /** 433 * binder_enqueue_thread_work() - Add an item to the thread work list 434 * @thread: thread to queue work to 435 * @work: struct binder_work to add to list 436 * 437 * Adds the work to the todo list of the thread, and enables processing 438 * of the todo queue. 439 */ 440 static void 441 binder_enqueue_thread_work(struct binder_thread *thread, 442 struct binder_work *work) 443 { 444 binder_inner_proc_lock(thread->proc); 445 binder_enqueue_thread_work_ilocked(thread, work); 446 binder_inner_proc_unlock(thread->proc); 447 } 448 449 static void 450 binder_dequeue_work_ilocked(struct binder_work *work) 451 { 452 list_del_init(&work->entry); 453 } 454 455 /** 456 * binder_dequeue_work() - Removes an item from the work list 457 * @proc: binder_proc associated with list 458 * @work: struct binder_work to remove from list 459 * 460 * Removes the specified work item from whatever list it is on. 461 * Can safely be called if work is not on any list. 462 */ 463 static void 464 binder_dequeue_work(struct binder_proc *proc, struct binder_work *work) 465 { 466 binder_inner_proc_lock(proc); 467 binder_dequeue_work_ilocked(work); 468 binder_inner_proc_unlock(proc); 469 } 470 471 static struct binder_work *binder_dequeue_work_head_ilocked( 472 struct list_head *list) 473 { 474 struct binder_work *w; 475 476 w = list_first_entry_or_null(list, struct binder_work, entry); 477 if (w) 478 list_del_init(&w->entry); 479 return w; 480 } 481 482 static void 483 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer); 484 static void binder_free_thread(struct binder_thread *thread); 485 static void binder_free_proc(struct binder_proc *proc); 486 static void binder_inc_node_tmpref_ilocked(struct binder_node *node); 487 488 static bool binder_has_work_ilocked(struct binder_thread *thread, 489 bool do_proc_work) 490 { 491 return thread->process_todo || 492 thread->looper_need_return || 493 (do_proc_work && 494 !binder_worklist_empty_ilocked(&thread->proc->todo)); 495 } 496 497 static bool binder_has_work(struct binder_thread *thread, bool do_proc_work) 498 { 499 bool has_work; 500 501 binder_inner_proc_lock(thread->proc); 502 has_work = binder_has_work_ilocked(thread, do_proc_work); 503 binder_inner_proc_unlock(thread->proc); 504 505 return has_work; 506 } 507 508 static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread) 509 { 510 return !thread->transaction_stack && 511 binder_worklist_empty_ilocked(&thread->todo) && 512 (thread->looper & (BINDER_LOOPER_STATE_ENTERED | 513 BINDER_LOOPER_STATE_REGISTERED)); 514 } 515 516 static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc, 517 bool sync) 518 { 519 struct rb_node *n; 520 struct binder_thread *thread; 521 522 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 523 thread = rb_entry(n, struct binder_thread, rb_node); 524 if (thread->looper & BINDER_LOOPER_STATE_POLL && 525 binder_available_for_proc_work_ilocked(thread)) { 526 if (sync) 527 wake_up_interruptible_sync(&thread->wait); 528 else 529 wake_up_interruptible(&thread->wait); 530 } 531 } 532 } 533 534 /** 535 * binder_select_thread_ilocked() - selects a thread for doing proc work. 536 * @proc: process to select a thread from 537 * 538 * Note that calling this function moves the thread off the waiting_threads 539 * list, so it can only be woken up by the caller of this function, or a 540 * signal. Therefore, callers *should* always wake up the thread this function 541 * returns. 542 * 543 * Return: If there's a thread currently waiting for process work, 544 * returns that thread. Otherwise returns NULL. 545 */ 546 static struct binder_thread * 547 binder_select_thread_ilocked(struct binder_proc *proc) 548 { 549 struct binder_thread *thread; 550 551 assert_spin_locked(&proc->inner_lock); 552 thread = list_first_entry_or_null(&proc->waiting_threads, 553 struct binder_thread, 554 waiting_thread_node); 555 556 if (thread) 557 list_del_init(&thread->waiting_thread_node); 558 559 return thread; 560 } 561 562 /** 563 * binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work. 564 * @proc: process to wake up a thread in 565 * @thread: specific thread to wake-up (may be NULL) 566 * @sync: whether to do a synchronous wake-up 567 * 568 * This function wakes up a thread in the @proc process. 569 * The caller may provide a specific thread to wake-up in 570 * the @thread parameter. If @thread is NULL, this function 571 * will wake up threads that have called poll(). 572 * 573 * Note that for this function to work as expected, callers 574 * should first call binder_select_thread() to find a thread 575 * to handle the work (if they don't have a thread already), 576 * and pass the result into the @thread parameter. 577 */ 578 static void binder_wakeup_thread_ilocked(struct binder_proc *proc, 579 struct binder_thread *thread, 580 bool sync) 581 { 582 assert_spin_locked(&proc->inner_lock); 583 584 if (thread) { 585 if (sync) 586 wake_up_interruptible_sync(&thread->wait); 587 else 588 wake_up_interruptible(&thread->wait); 589 return; 590 } 591 592 /* Didn't find a thread waiting for proc work; this can happen 593 * in two scenarios: 594 * 1. All threads are busy handling transactions 595 * In that case, one of those threads should call back into 596 * the kernel driver soon and pick up this work. 597 * 2. Threads are using the (e)poll interface, in which case 598 * they may be blocked on the waitqueue without having been 599 * added to waiting_threads. For this case, we just iterate 600 * over all threads not handling transaction work, and 601 * wake them all up. We wake all because we don't know whether 602 * a thread that called into (e)poll is handling non-binder 603 * work currently. 604 */ 605 binder_wakeup_poll_threads_ilocked(proc, sync); 606 } 607 608 static void binder_wakeup_proc_ilocked(struct binder_proc *proc) 609 { 610 struct binder_thread *thread = binder_select_thread_ilocked(proc); 611 612 binder_wakeup_thread_ilocked(proc, thread, /* sync = */false); 613 } 614 615 static void binder_set_nice(long nice) 616 { 617 long min_nice; 618 619 if (can_nice(current, nice)) { 620 set_user_nice(current, nice); 621 return; 622 } 623 min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE)); 624 binder_debug(BINDER_DEBUG_PRIORITY_CAP, 625 "%d: nice value %ld not allowed use %ld instead\n", 626 current->pid, nice, min_nice); 627 set_user_nice(current, min_nice); 628 if (min_nice <= MAX_NICE) 629 return; 630 binder_user_error("%d RLIMIT_NICE not set\n", current->pid); 631 } 632 633 static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc, 634 binder_uintptr_t ptr) 635 { 636 struct rb_node *n = proc->nodes.rb_node; 637 struct binder_node *node; 638 639 assert_spin_locked(&proc->inner_lock); 640 641 while (n) { 642 node = rb_entry(n, struct binder_node, rb_node); 643 644 if (ptr < node->ptr) 645 n = n->rb_left; 646 else if (ptr > node->ptr) 647 n = n->rb_right; 648 else { 649 /* 650 * take an implicit weak reference 651 * to ensure node stays alive until 652 * call to binder_put_node() 653 */ 654 binder_inc_node_tmpref_ilocked(node); 655 return node; 656 } 657 } 658 return NULL; 659 } 660 661 static struct binder_node *binder_get_node(struct binder_proc *proc, 662 binder_uintptr_t ptr) 663 { 664 struct binder_node *node; 665 666 binder_inner_proc_lock(proc); 667 node = binder_get_node_ilocked(proc, ptr); 668 binder_inner_proc_unlock(proc); 669 return node; 670 } 671 672 static struct binder_node *binder_init_node_ilocked( 673 struct binder_proc *proc, 674 struct binder_node *new_node, 675 struct flat_binder_object *fp) 676 { 677 struct rb_node **p = &proc->nodes.rb_node; 678 struct rb_node *parent = NULL; 679 struct binder_node *node; 680 binder_uintptr_t ptr = fp ? fp->binder : 0; 681 binder_uintptr_t cookie = fp ? fp->cookie : 0; 682 __u32 flags = fp ? fp->flags : 0; 683 684 assert_spin_locked(&proc->inner_lock); 685 686 while (*p) { 687 688 parent = *p; 689 node = rb_entry(parent, struct binder_node, rb_node); 690 691 if (ptr < node->ptr) 692 p = &(*p)->rb_left; 693 else if (ptr > node->ptr) 694 p = &(*p)->rb_right; 695 else { 696 /* 697 * A matching node is already in 698 * the rb tree. Abandon the init 699 * and return it. 700 */ 701 binder_inc_node_tmpref_ilocked(node); 702 return node; 703 } 704 } 705 node = new_node; 706 binder_stats_created(BINDER_STAT_NODE); 707 node->tmp_refs++; 708 rb_link_node(&node->rb_node, parent, p); 709 rb_insert_color(&node->rb_node, &proc->nodes); 710 node->debug_id = atomic_inc_return(&binder_last_id); 711 node->proc = proc; 712 node->ptr = ptr; 713 node->cookie = cookie; 714 node->work.type = BINDER_WORK_NODE; 715 node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK; 716 node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS); 717 node->txn_security_ctx = !!(flags & FLAT_BINDER_FLAG_TXN_SECURITY_CTX); 718 spin_lock_init(&node->lock); 719 INIT_LIST_HEAD(&node->work.entry); 720 INIT_LIST_HEAD(&node->async_todo); 721 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 722 "%d:%d node %d u%016llx c%016llx created\n", 723 proc->pid, current->pid, node->debug_id, 724 (u64)node->ptr, (u64)node->cookie); 725 726 return node; 727 } 728 729 static struct binder_node *binder_new_node(struct binder_proc *proc, 730 struct flat_binder_object *fp) 731 { 732 struct binder_node *node; 733 struct binder_node *new_node = kzalloc(sizeof(*node), GFP_KERNEL); 734 735 if (!new_node) 736 return NULL; 737 binder_inner_proc_lock(proc); 738 node = binder_init_node_ilocked(proc, new_node, fp); 739 binder_inner_proc_unlock(proc); 740 if (node != new_node) 741 /* 742 * The node was already added by another thread 743 */ 744 kfree(new_node); 745 746 return node; 747 } 748 749 static void binder_free_node(struct binder_node *node) 750 { 751 kfree(node); 752 binder_stats_deleted(BINDER_STAT_NODE); 753 } 754 755 static int binder_inc_node_nilocked(struct binder_node *node, int strong, 756 int internal, 757 struct list_head *target_list) 758 { 759 struct binder_proc *proc = node->proc; 760 761 assert_spin_locked(&node->lock); 762 if (proc) 763 assert_spin_locked(&proc->inner_lock); 764 if (strong) { 765 if (internal) { 766 if (target_list == NULL && 767 node->internal_strong_refs == 0 && 768 !(node->proc && 769 node == node->proc->context->binder_context_mgr_node && 770 node->has_strong_ref)) { 771 pr_err("invalid inc strong node for %d\n", 772 node->debug_id); 773 return -EINVAL; 774 } 775 node->internal_strong_refs++; 776 } else 777 node->local_strong_refs++; 778 if (!node->has_strong_ref && target_list) { 779 struct binder_thread *thread = container_of(target_list, 780 struct binder_thread, todo); 781 binder_dequeue_work_ilocked(&node->work); 782 BUG_ON(&thread->todo != target_list); 783 binder_enqueue_deferred_thread_work_ilocked(thread, 784 &node->work); 785 } 786 } else { 787 if (!internal) 788 node->local_weak_refs++; 789 if (!node->has_weak_ref && list_empty(&node->work.entry)) { 790 if (target_list == NULL) { 791 pr_err("invalid inc weak node for %d\n", 792 node->debug_id); 793 return -EINVAL; 794 } 795 /* 796 * See comment above 797 */ 798 binder_enqueue_work_ilocked(&node->work, target_list); 799 } 800 } 801 return 0; 802 } 803 804 static int binder_inc_node(struct binder_node *node, int strong, int internal, 805 struct list_head *target_list) 806 { 807 int ret; 808 809 binder_node_inner_lock(node); 810 ret = binder_inc_node_nilocked(node, strong, internal, target_list); 811 binder_node_inner_unlock(node); 812 813 return ret; 814 } 815 816 static bool binder_dec_node_nilocked(struct binder_node *node, 817 int strong, int internal) 818 { 819 struct binder_proc *proc = node->proc; 820 821 assert_spin_locked(&node->lock); 822 if (proc) 823 assert_spin_locked(&proc->inner_lock); 824 if (strong) { 825 if (internal) 826 node->internal_strong_refs--; 827 else 828 node->local_strong_refs--; 829 if (node->local_strong_refs || node->internal_strong_refs) 830 return false; 831 } else { 832 if (!internal) 833 node->local_weak_refs--; 834 if (node->local_weak_refs || node->tmp_refs || 835 !hlist_empty(&node->refs)) 836 return false; 837 } 838 839 if (proc && (node->has_strong_ref || node->has_weak_ref)) { 840 if (list_empty(&node->work.entry)) { 841 binder_enqueue_work_ilocked(&node->work, &proc->todo); 842 binder_wakeup_proc_ilocked(proc); 843 } 844 } else { 845 if (hlist_empty(&node->refs) && !node->local_strong_refs && 846 !node->local_weak_refs && !node->tmp_refs) { 847 if (proc) { 848 binder_dequeue_work_ilocked(&node->work); 849 rb_erase(&node->rb_node, &proc->nodes); 850 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 851 "refless node %d deleted\n", 852 node->debug_id); 853 } else { 854 BUG_ON(!list_empty(&node->work.entry)); 855 spin_lock(&binder_dead_nodes_lock); 856 /* 857 * tmp_refs could have changed so 858 * check it again 859 */ 860 if (node->tmp_refs) { 861 spin_unlock(&binder_dead_nodes_lock); 862 return false; 863 } 864 hlist_del(&node->dead_node); 865 spin_unlock(&binder_dead_nodes_lock); 866 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 867 "dead node %d deleted\n", 868 node->debug_id); 869 } 870 return true; 871 } 872 } 873 return false; 874 } 875 876 static void binder_dec_node(struct binder_node *node, int strong, int internal) 877 { 878 bool free_node; 879 880 binder_node_inner_lock(node); 881 free_node = binder_dec_node_nilocked(node, strong, internal); 882 binder_node_inner_unlock(node); 883 if (free_node) 884 binder_free_node(node); 885 } 886 887 static void binder_inc_node_tmpref_ilocked(struct binder_node *node) 888 { 889 /* 890 * No call to binder_inc_node() is needed since we 891 * don't need to inform userspace of any changes to 892 * tmp_refs 893 */ 894 node->tmp_refs++; 895 } 896 897 /** 898 * binder_inc_node_tmpref() - take a temporary reference on node 899 * @node: node to reference 900 * 901 * Take reference on node to prevent the node from being freed 902 * while referenced only by a local variable. The inner lock is 903 * needed to serialize with the node work on the queue (which 904 * isn't needed after the node is dead). If the node is dead 905 * (node->proc is NULL), use binder_dead_nodes_lock to protect 906 * node->tmp_refs against dead-node-only cases where the node 907 * lock cannot be acquired (eg traversing the dead node list to 908 * print nodes) 909 */ 910 static void binder_inc_node_tmpref(struct binder_node *node) 911 { 912 binder_node_lock(node); 913 if (node->proc) 914 binder_inner_proc_lock(node->proc); 915 else 916 spin_lock(&binder_dead_nodes_lock); 917 binder_inc_node_tmpref_ilocked(node); 918 if (node->proc) 919 binder_inner_proc_unlock(node->proc); 920 else 921 spin_unlock(&binder_dead_nodes_lock); 922 binder_node_unlock(node); 923 } 924 925 /** 926 * binder_dec_node_tmpref() - remove a temporary reference on node 927 * @node: node to reference 928 * 929 * Release temporary reference on node taken via binder_inc_node_tmpref() 930 */ 931 static void binder_dec_node_tmpref(struct binder_node *node) 932 { 933 bool free_node; 934 935 binder_node_inner_lock(node); 936 if (!node->proc) 937 spin_lock(&binder_dead_nodes_lock); 938 else 939 __acquire(&binder_dead_nodes_lock); 940 node->tmp_refs--; 941 BUG_ON(node->tmp_refs < 0); 942 if (!node->proc) 943 spin_unlock(&binder_dead_nodes_lock); 944 else 945 __release(&binder_dead_nodes_lock); 946 /* 947 * Call binder_dec_node() to check if all refcounts are 0 948 * and cleanup is needed. Calling with strong=0 and internal=1 949 * causes no actual reference to be released in binder_dec_node(). 950 * If that changes, a change is needed here too. 951 */ 952 free_node = binder_dec_node_nilocked(node, 0, 1); 953 binder_node_inner_unlock(node); 954 if (free_node) 955 binder_free_node(node); 956 } 957 958 static void binder_put_node(struct binder_node *node) 959 { 960 binder_dec_node_tmpref(node); 961 } 962 963 static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc, 964 u32 desc, bool need_strong_ref) 965 { 966 struct rb_node *n = proc->refs_by_desc.rb_node; 967 struct binder_ref *ref; 968 969 while (n) { 970 ref = rb_entry(n, struct binder_ref, rb_node_desc); 971 972 if (desc < ref->data.desc) { 973 n = n->rb_left; 974 } else if (desc > ref->data.desc) { 975 n = n->rb_right; 976 } else if (need_strong_ref && !ref->data.strong) { 977 binder_user_error("tried to use weak ref as strong ref\n"); 978 return NULL; 979 } else { 980 return ref; 981 } 982 } 983 return NULL; 984 } 985 986 /** 987 * binder_get_ref_for_node_olocked() - get the ref associated with given node 988 * @proc: binder_proc that owns the ref 989 * @node: binder_node of target 990 * @new_ref: newly allocated binder_ref to be initialized or %NULL 991 * 992 * Look up the ref for the given node and return it if it exists 993 * 994 * If it doesn't exist and the caller provides a newly allocated 995 * ref, initialize the fields of the newly allocated ref and insert 996 * into the given proc rb_trees and node refs list. 997 * 998 * Return: the ref for node. It is possible that another thread 999 * allocated/initialized the ref first in which case the 1000 * returned ref would be different than the passed-in 1001 * new_ref. new_ref must be kfree'd by the caller in 1002 * this case. 1003 */ 1004 static struct binder_ref *binder_get_ref_for_node_olocked( 1005 struct binder_proc *proc, 1006 struct binder_node *node, 1007 struct binder_ref *new_ref) 1008 { 1009 struct binder_context *context = proc->context; 1010 struct rb_node **p = &proc->refs_by_node.rb_node; 1011 struct rb_node *parent = NULL; 1012 struct binder_ref *ref; 1013 struct rb_node *n; 1014 1015 while (*p) { 1016 parent = *p; 1017 ref = rb_entry(parent, struct binder_ref, rb_node_node); 1018 1019 if (node < ref->node) 1020 p = &(*p)->rb_left; 1021 else if (node > ref->node) 1022 p = &(*p)->rb_right; 1023 else 1024 return ref; 1025 } 1026 if (!new_ref) 1027 return NULL; 1028 1029 binder_stats_created(BINDER_STAT_REF); 1030 new_ref->data.debug_id = atomic_inc_return(&binder_last_id); 1031 new_ref->proc = proc; 1032 new_ref->node = node; 1033 rb_link_node(&new_ref->rb_node_node, parent, p); 1034 rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node); 1035 1036 new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1; 1037 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 1038 ref = rb_entry(n, struct binder_ref, rb_node_desc); 1039 if (ref->data.desc > new_ref->data.desc) 1040 break; 1041 new_ref->data.desc = ref->data.desc + 1; 1042 } 1043 1044 p = &proc->refs_by_desc.rb_node; 1045 while (*p) { 1046 parent = *p; 1047 ref = rb_entry(parent, struct binder_ref, rb_node_desc); 1048 1049 if (new_ref->data.desc < ref->data.desc) 1050 p = &(*p)->rb_left; 1051 else if (new_ref->data.desc > ref->data.desc) 1052 p = &(*p)->rb_right; 1053 else 1054 BUG(); 1055 } 1056 rb_link_node(&new_ref->rb_node_desc, parent, p); 1057 rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc); 1058 1059 binder_node_lock(node); 1060 hlist_add_head(&new_ref->node_entry, &node->refs); 1061 1062 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1063 "%d new ref %d desc %d for node %d\n", 1064 proc->pid, new_ref->data.debug_id, new_ref->data.desc, 1065 node->debug_id); 1066 binder_node_unlock(node); 1067 return new_ref; 1068 } 1069 1070 static void binder_cleanup_ref_olocked(struct binder_ref *ref) 1071 { 1072 bool delete_node = false; 1073 1074 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 1075 "%d delete ref %d desc %d for node %d\n", 1076 ref->proc->pid, ref->data.debug_id, ref->data.desc, 1077 ref->node->debug_id); 1078 1079 rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc); 1080 rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node); 1081 1082 binder_node_inner_lock(ref->node); 1083 if (ref->data.strong) 1084 binder_dec_node_nilocked(ref->node, 1, 1); 1085 1086 hlist_del(&ref->node_entry); 1087 delete_node = binder_dec_node_nilocked(ref->node, 0, 1); 1088 binder_node_inner_unlock(ref->node); 1089 /* 1090 * Clear ref->node unless we want the caller to free the node 1091 */ 1092 if (!delete_node) { 1093 /* 1094 * The caller uses ref->node to determine 1095 * whether the node needs to be freed. Clear 1096 * it since the node is still alive. 1097 */ 1098 ref->node = NULL; 1099 } 1100 1101 if (ref->death) { 1102 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1103 "%d delete ref %d desc %d has death notification\n", 1104 ref->proc->pid, ref->data.debug_id, 1105 ref->data.desc); 1106 binder_dequeue_work(ref->proc, &ref->death->work); 1107 binder_stats_deleted(BINDER_STAT_DEATH); 1108 } 1109 binder_stats_deleted(BINDER_STAT_REF); 1110 } 1111 1112 /** 1113 * binder_inc_ref_olocked() - increment the ref for given handle 1114 * @ref: ref to be incremented 1115 * @strong: if true, strong increment, else weak 1116 * @target_list: list to queue node work on 1117 * 1118 * Increment the ref. @ref->proc->outer_lock must be held on entry 1119 * 1120 * Return: 0, if successful, else errno 1121 */ 1122 static int binder_inc_ref_olocked(struct binder_ref *ref, int strong, 1123 struct list_head *target_list) 1124 { 1125 int ret; 1126 1127 if (strong) { 1128 if (ref->data.strong == 0) { 1129 ret = binder_inc_node(ref->node, 1, 1, target_list); 1130 if (ret) 1131 return ret; 1132 } 1133 ref->data.strong++; 1134 } else { 1135 if (ref->data.weak == 0) { 1136 ret = binder_inc_node(ref->node, 0, 1, target_list); 1137 if (ret) 1138 return ret; 1139 } 1140 ref->data.weak++; 1141 } 1142 return 0; 1143 } 1144 1145 /** 1146 * binder_dec_ref() - dec the ref for given handle 1147 * @ref: ref to be decremented 1148 * @strong: if true, strong decrement, else weak 1149 * 1150 * Decrement the ref. 1151 * 1152 * Return: true if ref is cleaned up and ready to be freed 1153 */ 1154 static bool binder_dec_ref_olocked(struct binder_ref *ref, int strong) 1155 { 1156 if (strong) { 1157 if (ref->data.strong == 0) { 1158 binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n", 1159 ref->proc->pid, ref->data.debug_id, 1160 ref->data.desc, ref->data.strong, 1161 ref->data.weak); 1162 return false; 1163 } 1164 ref->data.strong--; 1165 if (ref->data.strong == 0) 1166 binder_dec_node(ref->node, strong, 1); 1167 } else { 1168 if (ref->data.weak == 0) { 1169 binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n", 1170 ref->proc->pid, ref->data.debug_id, 1171 ref->data.desc, ref->data.strong, 1172 ref->data.weak); 1173 return false; 1174 } 1175 ref->data.weak--; 1176 } 1177 if (ref->data.strong == 0 && ref->data.weak == 0) { 1178 binder_cleanup_ref_olocked(ref); 1179 return true; 1180 } 1181 return false; 1182 } 1183 1184 /** 1185 * binder_get_node_from_ref() - get the node from the given proc/desc 1186 * @proc: proc containing the ref 1187 * @desc: the handle associated with the ref 1188 * @need_strong_ref: if true, only return node if ref is strong 1189 * @rdata: the id/refcount data for the ref 1190 * 1191 * Given a proc and ref handle, return the associated binder_node 1192 * 1193 * Return: a binder_node or NULL if not found or not strong when strong required 1194 */ 1195 static struct binder_node *binder_get_node_from_ref( 1196 struct binder_proc *proc, 1197 u32 desc, bool need_strong_ref, 1198 struct binder_ref_data *rdata) 1199 { 1200 struct binder_node *node; 1201 struct binder_ref *ref; 1202 1203 binder_proc_lock(proc); 1204 ref = binder_get_ref_olocked(proc, desc, need_strong_ref); 1205 if (!ref) 1206 goto err_no_ref; 1207 node = ref->node; 1208 /* 1209 * Take an implicit reference on the node to ensure 1210 * it stays alive until the call to binder_put_node() 1211 */ 1212 binder_inc_node_tmpref(node); 1213 if (rdata) 1214 *rdata = ref->data; 1215 binder_proc_unlock(proc); 1216 1217 return node; 1218 1219 err_no_ref: 1220 binder_proc_unlock(proc); 1221 return NULL; 1222 } 1223 1224 /** 1225 * binder_free_ref() - free the binder_ref 1226 * @ref: ref to free 1227 * 1228 * Free the binder_ref. Free the binder_node indicated by ref->node 1229 * (if non-NULL) and the binder_ref_death indicated by ref->death. 1230 */ 1231 static void binder_free_ref(struct binder_ref *ref) 1232 { 1233 if (ref->node) 1234 binder_free_node(ref->node); 1235 kfree(ref->death); 1236 kfree(ref); 1237 } 1238 1239 /** 1240 * binder_update_ref_for_handle() - inc/dec the ref for given handle 1241 * @proc: proc containing the ref 1242 * @desc: the handle associated with the ref 1243 * @increment: true=inc reference, false=dec reference 1244 * @strong: true=strong reference, false=weak reference 1245 * @rdata: the id/refcount data for the ref 1246 * 1247 * Given a proc and ref handle, increment or decrement the ref 1248 * according to "increment" arg. 1249 * 1250 * Return: 0 if successful, else errno 1251 */ 1252 static int binder_update_ref_for_handle(struct binder_proc *proc, 1253 uint32_t desc, bool increment, bool strong, 1254 struct binder_ref_data *rdata) 1255 { 1256 int ret = 0; 1257 struct binder_ref *ref; 1258 bool delete_ref = false; 1259 1260 binder_proc_lock(proc); 1261 ref = binder_get_ref_olocked(proc, desc, strong); 1262 if (!ref) { 1263 ret = -EINVAL; 1264 goto err_no_ref; 1265 } 1266 if (increment) 1267 ret = binder_inc_ref_olocked(ref, strong, NULL); 1268 else 1269 delete_ref = binder_dec_ref_olocked(ref, strong); 1270 1271 if (rdata) 1272 *rdata = ref->data; 1273 binder_proc_unlock(proc); 1274 1275 if (delete_ref) 1276 binder_free_ref(ref); 1277 return ret; 1278 1279 err_no_ref: 1280 binder_proc_unlock(proc); 1281 return ret; 1282 } 1283 1284 /** 1285 * binder_dec_ref_for_handle() - dec the ref for given handle 1286 * @proc: proc containing the ref 1287 * @desc: the handle associated with the ref 1288 * @strong: true=strong reference, false=weak reference 1289 * @rdata: the id/refcount data for the ref 1290 * 1291 * Just calls binder_update_ref_for_handle() to decrement the ref. 1292 * 1293 * Return: 0 if successful, else errno 1294 */ 1295 static int binder_dec_ref_for_handle(struct binder_proc *proc, 1296 uint32_t desc, bool strong, struct binder_ref_data *rdata) 1297 { 1298 return binder_update_ref_for_handle(proc, desc, false, strong, rdata); 1299 } 1300 1301 1302 /** 1303 * binder_inc_ref_for_node() - increment the ref for given proc/node 1304 * @proc: proc containing the ref 1305 * @node: target node 1306 * @strong: true=strong reference, false=weak reference 1307 * @target_list: worklist to use if node is incremented 1308 * @rdata: the id/refcount data for the ref 1309 * 1310 * Given a proc and node, increment the ref. Create the ref if it 1311 * doesn't already exist 1312 * 1313 * Return: 0 if successful, else errno 1314 */ 1315 static int binder_inc_ref_for_node(struct binder_proc *proc, 1316 struct binder_node *node, 1317 bool strong, 1318 struct list_head *target_list, 1319 struct binder_ref_data *rdata) 1320 { 1321 struct binder_ref *ref; 1322 struct binder_ref *new_ref = NULL; 1323 int ret = 0; 1324 1325 binder_proc_lock(proc); 1326 ref = binder_get_ref_for_node_olocked(proc, node, NULL); 1327 if (!ref) { 1328 binder_proc_unlock(proc); 1329 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL); 1330 if (!new_ref) 1331 return -ENOMEM; 1332 binder_proc_lock(proc); 1333 ref = binder_get_ref_for_node_olocked(proc, node, new_ref); 1334 } 1335 ret = binder_inc_ref_olocked(ref, strong, target_list); 1336 *rdata = ref->data; 1337 binder_proc_unlock(proc); 1338 if (new_ref && ref != new_ref) 1339 /* 1340 * Another thread created the ref first so 1341 * free the one we allocated 1342 */ 1343 kfree(new_ref); 1344 return ret; 1345 } 1346 1347 static void binder_pop_transaction_ilocked(struct binder_thread *target_thread, 1348 struct binder_transaction *t) 1349 { 1350 BUG_ON(!target_thread); 1351 assert_spin_locked(&target_thread->proc->inner_lock); 1352 BUG_ON(target_thread->transaction_stack != t); 1353 BUG_ON(target_thread->transaction_stack->from != target_thread); 1354 target_thread->transaction_stack = 1355 target_thread->transaction_stack->from_parent; 1356 t->from = NULL; 1357 } 1358 1359 /** 1360 * binder_thread_dec_tmpref() - decrement thread->tmp_ref 1361 * @thread: thread to decrement 1362 * 1363 * A thread needs to be kept alive while being used to create or 1364 * handle a transaction. binder_get_txn_from() is used to safely 1365 * extract t->from from a binder_transaction and keep the thread 1366 * indicated by t->from from being freed. When done with that 1367 * binder_thread, this function is called to decrement the 1368 * tmp_ref and free if appropriate (thread has been released 1369 * and no transaction being processed by the driver) 1370 */ 1371 static void binder_thread_dec_tmpref(struct binder_thread *thread) 1372 { 1373 /* 1374 * atomic is used to protect the counter value while 1375 * it cannot reach zero or thread->is_dead is false 1376 */ 1377 binder_inner_proc_lock(thread->proc); 1378 atomic_dec(&thread->tmp_ref); 1379 if (thread->is_dead && !atomic_read(&thread->tmp_ref)) { 1380 binder_inner_proc_unlock(thread->proc); 1381 binder_free_thread(thread); 1382 return; 1383 } 1384 binder_inner_proc_unlock(thread->proc); 1385 } 1386 1387 /** 1388 * binder_proc_dec_tmpref() - decrement proc->tmp_ref 1389 * @proc: proc to decrement 1390 * 1391 * A binder_proc needs to be kept alive while being used to create or 1392 * handle a transaction. proc->tmp_ref is incremented when 1393 * creating a new transaction or the binder_proc is currently in-use 1394 * by threads that are being released. When done with the binder_proc, 1395 * this function is called to decrement the counter and free the 1396 * proc if appropriate (proc has been released, all threads have 1397 * been released and not currenly in-use to process a transaction). 1398 */ 1399 static void binder_proc_dec_tmpref(struct binder_proc *proc) 1400 { 1401 binder_inner_proc_lock(proc); 1402 proc->tmp_ref--; 1403 if (proc->is_dead && RB_EMPTY_ROOT(&proc->threads) && 1404 !proc->tmp_ref) { 1405 binder_inner_proc_unlock(proc); 1406 binder_free_proc(proc); 1407 return; 1408 } 1409 binder_inner_proc_unlock(proc); 1410 } 1411 1412 /** 1413 * binder_get_txn_from() - safely extract the "from" thread in transaction 1414 * @t: binder transaction for t->from 1415 * 1416 * Atomically return the "from" thread and increment the tmp_ref 1417 * count for the thread to ensure it stays alive until 1418 * binder_thread_dec_tmpref() is called. 1419 * 1420 * Return: the value of t->from 1421 */ 1422 static struct binder_thread *binder_get_txn_from( 1423 struct binder_transaction *t) 1424 { 1425 struct binder_thread *from; 1426 1427 spin_lock(&t->lock); 1428 from = t->from; 1429 if (from) 1430 atomic_inc(&from->tmp_ref); 1431 spin_unlock(&t->lock); 1432 return from; 1433 } 1434 1435 /** 1436 * binder_get_txn_from_and_acq_inner() - get t->from and acquire inner lock 1437 * @t: binder transaction for t->from 1438 * 1439 * Same as binder_get_txn_from() except it also acquires the proc->inner_lock 1440 * to guarantee that the thread cannot be released while operating on it. 1441 * The caller must call binder_inner_proc_unlock() to release the inner lock 1442 * as well as call binder_dec_thread_txn() to release the reference. 1443 * 1444 * Return: the value of t->from 1445 */ 1446 static struct binder_thread *binder_get_txn_from_and_acq_inner( 1447 struct binder_transaction *t) 1448 __acquires(&t->from->proc->inner_lock) 1449 { 1450 struct binder_thread *from; 1451 1452 from = binder_get_txn_from(t); 1453 if (!from) { 1454 __acquire(&from->proc->inner_lock); 1455 return NULL; 1456 } 1457 binder_inner_proc_lock(from->proc); 1458 if (t->from) { 1459 BUG_ON(from != t->from); 1460 return from; 1461 } 1462 binder_inner_proc_unlock(from->proc); 1463 __acquire(&from->proc->inner_lock); 1464 binder_thread_dec_tmpref(from); 1465 return NULL; 1466 } 1467 1468 /** 1469 * binder_free_txn_fixups() - free unprocessed fd fixups 1470 * @t: binder transaction for t->from 1471 * 1472 * If the transaction is being torn down prior to being 1473 * processed by the target process, free all of the 1474 * fd fixups and fput the file structs. It is safe to 1475 * call this function after the fixups have been 1476 * processed -- in that case, the list will be empty. 1477 */ 1478 static void binder_free_txn_fixups(struct binder_transaction *t) 1479 { 1480 struct binder_txn_fd_fixup *fixup, *tmp; 1481 1482 list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) { 1483 fput(fixup->file); 1484 if (fixup->target_fd >= 0) 1485 put_unused_fd(fixup->target_fd); 1486 list_del(&fixup->fixup_entry); 1487 kfree(fixup); 1488 } 1489 } 1490 1491 static void binder_txn_latency_free(struct binder_transaction *t) 1492 { 1493 int from_proc, from_thread, to_proc, to_thread; 1494 1495 spin_lock(&t->lock); 1496 from_proc = t->from ? t->from->proc->pid : 0; 1497 from_thread = t->from ? t->from->pid : 0; 1498 to_proc = t->to_proc ? t->to_proc->pid : 0; 1499 to_thread = t->to_thread ? t->to_thread->pid : 0; 1500 spin_unlock(&t->lock); 1501 1502 trace_binder_txn_latency_free(t, from_proc, from_thread, to_proc, to_thread); 1503 } 1504 1505 static void binder_free_transaction(struct binder_transaction *t) 1506 { 1507 struct binder_proc *target_proc = t->to_proc; 1508 1509 if (target_proc) { 1510 binder_inner_proc_lock(target_proc); 1511 target_proc->outstanding_txns--; 1512 if (target_proc->outstanding_txns < 0) 1513 pr_warn("%s: Unexpected outstanding_txns %d\n", 1514 __func__, target_proc->outstanding_txns); 1515 if (!target_proc->outstanding_txns && target_proc->is_frozen) 1516 wake_up_interruptible_all(&target_proc->freeze_wait); 1517 if (t->buffer) 1518 t->buffer->transaction = NULL; 1519 binder_inner_proc_unlock(target_proc); 1520 } 1521 if (trace_binder_txn_latency_free_enabled()) 1522 binder_txn_latency_free(t); 1523 /* 1524 * If the transaction has no target_proc, then 1525 * t->buffer->transaction has already been cleared. 1526 */ 1527 binder_free_txn_fixups(t); 1528 kfree(t); 1529 binder_stats_deleted(BINDER_STAT_TRANSACTION); 1530 } 1531 1532 static void binder_send_failed_reply(struct binder_transaction *t, 1533 uint32_t error_code) 1534 { 1535 struct binder_thread *target_thread; 1536 struct binder_transaction *next; 1537 1538 BUG_ON(t->flags & TF_ONE_WAY); 1539 while (1) { 1540 target_thread = binder_get_txn_from_and_acq_inner(t); 1541 if (target_thread) { 1542 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1543 "send failed reply for transaction %d to %d:%d\n", 1544 t->debug_id, 1545 target_thread->proc->pid, 1546 target_thread->pid); 1547 1548 binder_pop_transaction_ilocked(target_thread, t); 1549 if (target_thread->reply_error.cmd == BR_OK) { 1550 target_thread->reply_error.cmd = error_code; 1551 binder_enqueue_thread_work_ilocked( 1552 target_thread, 1553 &target_thread->reply_error.work); 1554 wake_up_interruptible(&target_thread->wait); 1555 } else { 1556 /* 1557 * Cannot get here for normal operation, but 1558 * we can if multiple synchronous transactions 1559 * are sent without blocking for responses. 1560 * Just ignore the 2nd error in this case. 1561 */ 1562 pr_warn("Unexpected reply error: %u\n", 1563 target_thread->reply_error.cmd); 1564 } 1565 binder_inner_proc_unlock(target_thread->proc); 1566 binder_thread_dec_tmpref(target_thread); 1567 binder_free_transaction(t); 1568 return; 1569 } 1570 __release(&target_thread->proc->inner_lock); 1571 next = t->from_parent; 1572 1573 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 1574 "send failed reply for transaction %d, target dead\n", 1575 t->debug_id); 1576 1577 binder_free_transaction(t); 1578 if (next == NULL) { 1579 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1580 "reply failed, no target thread at root\n"); 1581 return; 1582 } 1583 t = next; 1584 binder_debug(BINDER_DEBUG_DEAD_BINDER, 1585 "reply failed, no target thread -- retry %d\n", 1586 t->debug_id); 1587 } 1588 } 1589 1590 /** 1591 * binder_cleanup_transaction() - cleans up undelivered transaction 1592 * @t: transaction that needs to be cleaned up 1593 * @reason: reason the transaction wasn't delivered 1594 * @error_code: error to return to caller (if synchronous call) 1595 */ 1596 static void binder_cleanup_transaction(struct binder_transaction *t, 1597 const char *reason, 1598 uint32_t error_code) 1599 { 1600 if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) { 1601 binder_send_failed_reply(t, error_code); 1602 } else { 1603 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 1604 "undelivered transaction %d, %s\n", 1605 t->debug_id, reason); 1606 binder_free_transaction(t); 1607 } 1608 } 1609 1610 /** 1611 * binder_get_object() - gets object and checks for valid metadata 1612 * @proc: binder_proc owning the buffer 1613 * @u: sender's user pointer to base of buffer 1614 * @buffer: binder_buffer that we're parsing. 1615 * @offset: offset in the @buffer at which to validate an object. 1616 * @object: struct binder_object to read into 1617 * 1618 * Copy the binder object at the given offset into @object. If @u is 1619 * provided then the copy is from the sender's buffer. If not, then 1620 * it is copied from the target's @buffer. 1621 * 1622 * Return: If there's a valid metadata object at @offset, the 1623 * size of that object. Otherwise, it returns zero. The object 1624 * is read into the struct binder_object pointed to by @object. 1625 */ 1626 static size_t binder_get_object(struct binder_proc *proc, 1627 const void __user *u, 1628 struct binder_buffer *buffer, 1629 unsigned long offset, 1630 struct binder_object *object) 1631 { 1632 size_t read_size; 1633 struct binder_object_header *hdr; 1634 size_t object_size = 0; 1635 1636 read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset); 1637 if (offset > buffer->data_size || read_size < sizeof(*hdr)) 1638 return 0; 1639 if (u) { 1640 if (copy_from_user(object, u + offset, read_size)) 1641 return 0; 1642 } else { 1643 if (binder_alloc_copy_from_buffer(&proc->alloc, object, buffer, 1644 offset, read_size)) 1645 return 0; 1646 } 1647 1648 /* Ok, now see if we read a complete object. */ 1649 hdr = &object->hdr; 1650 switch (hdr->type) { 1651 case BINDER_TYPE_BINDER: 1652 case BINDER_TYPE_WEAK_BINDER: 1653 case BINDER_TYPE_HANDLE: 1654 case BINDER_TYPE_WEAK_HANDLE: 1655 object_size = sizeof(struct flat_binder_object); 1656 break; 1657 case BINDER_TYPE_FD: 1658 object_size = sizeof(struct binder_fd_object); 1659 break; 1660 case BINDER_TYPE_PTR: 1661 object_size = sizeof(struct binder_buffer_object); 1662 break; 1663 case BINDER_TYPE_FDA: 1664 object_size = sizeof(struct binder_fd_array_object); 1665 break; 1666 default: 1667 return 0; 1668 } 1669 if (offset <= buffer->data_size - object_size && 1670 buffer->data_size >= object_size) 1671 return object_size; 1672 else 1673 return 0; 1674 } 1675 1676 /** 1677 * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer. 1678 * @proc: binder_proc owning the buffer 1679 * @b: binder_buffer containing the object 1680 * @object: struct binder_object to read into 1681 * @index: index in offset array at which the binder_buffer_object is 1682 * located 1683 * @start_offset: points to the start of the offset array 1684 * @object_offsetp: offset of @object read from @b 1685 * @num_valid: the number of valid offsets in the offset array 1686 * 1687 * Return: If @index is within the valid range of the offset array 1688 * described by @start and @num_valid, and if there's a valid 1689 * binder_buffer_object at the offset found in index @index 1690 * of the offset array, that object is returned. Otherwise, 1691 * %NULL is returned. 1692 * Note that the offset found in index @index itself is not 1693 * verified; this function assumes that @num_valid elements 1694 * from @start were previously verified to have valid offsets. 1695 * If @object_offsetp is non-NULL, then the offset within 1696 * @b is written to it. 1697 */ 1698 static struct binder_buffer_object *binder_validate_ptr( 1699 struct binder_proc *proc, 1700 struct binder_buffer *b, 1701 struct binder_object *object, 1702 binder_size_t index, 1703 binder_size_t start_offset, 1704 binder_size_t *object_offsetp, 1705 binder_size_t num_valid) 1706 { 1707 size_t object_size; 1708 binder_size_t object_offset; 1709 unsigned long buffer_offset; 1710 1711 if (index >= num_valid) 1712 return NULL; 1713 1714 buffer_offset = start_offset + sizeof(binder_size_t) * index; 1715 if (binder_alloc_copy_from_buffer(&proc->alloc, &object_offset, 1716 b, buffer_offset, 1717 sizeof(object_offset))) 1718 return NULL; 1719 object_size = binder_get_object(proc, NULL, b, object_offset, object); 1720 if (!object_size || object->hdr.type != BINDER_TYPE_PTR) 1721 return NULL; 1722 if (object_offsetp) 1723 *object_offsetp = object_offset; 1724 1725 return &object->bbo; 1726 } 1727 1728 /** 1729 * binder_validate_fixup() - validates pointer/fd fixups happen in order. 1730 * @proc: binder_proc owning the buffer 1731 * @b: transaction buffer 1732 * @objects_start_offset: offset to start of objects buffer 1733 * @buffer_obj_offset: offset to binder_buffer_object in which to fix up 1734 * @fixup_offset: start offset in @buffer to fix up 1735 * @last_obj_offset: offset to last binder_buffer_object that we fixed 1736 * @last_min_offset: minimum fixup offset in object at @last_obj_offset 1737 * 1738 * Return: %true if a fixup in buffer @buffer at offset @offset is 1739 * allowed. 1740 * 1741 * For safety reasons, we only allow fixups inside a buffer to happen 1742 * at increasing offsets; additionally, we only allow fixup on the last 1743 * buffer object that was verified, or one of its parents. 1744 * 1745 * Example of what is allowed: 1746 * 1747 * A 1748 * B (parent = A, offset = 0) 1749 * C (parent = A, offset = 16) 1750 * D (parent = C, offset = 0) 1751 * E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset) 1752 * 1753 * Examples of what is not allowed: 1754 * 1755 * Decreasing offsets within the same parent: 1756 * A 1757 * C (parent = A, offset = 16) 1758 * B (parent = A, offset = 0) // decreasing offset within A 1759 * 1760 * Referring to a parent that wasn't the last object or any of its parents: 1761 * A 1762 * B (parent = A, offset = 0) 1763 * C (parent = A, offset = 0) 1764 * C (parent = A, offset = 16) 1765 * D (parent = B, offset = 0) // B is not A or any of A's parents 1766 */ 1767 static bool binder_validate_fixup(struct binder_proc *proc, 1768 struct binder_buffer *b, 1769 binder_size_t objects_start_offset, 1770 binder_size_t buffer_obj_offset, 1771 binder_size_t fixup_offset, 1772 binder_size_t last_obj_offset, 1773 binder_size_t last_min_offset) 1774 { 1775 if (!last_obj_offset) { 1776 /* Nothing to fix up in */ 1777 return false; 1778 } 1779 1780 while (last_obj_offset != buffer_obj_offset) { 1781 unsigned long buffer_offset; 1782 struct binder_object last_object; 1783 struct binder_buffer_object *last_bbo; 1784 size_t object_size = binder_get_object(proc, NULL, b, 1785 last_obj_offset, 1786 &last_object); 1787 if (object_size != sizeof(*last_bbo)) 1788 return false; 1789 1790 last_bbo = &last_object.bbo; 1791 /* 1792 * Safe to retrieve the parent of last_obj, since it 1793 * was already previously verified by the driver. 1794 */ 1795 if ((last_bbo->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0) 1796 return false; 1797 last_min_offset = last_bbo->parent_offset + sizeof(uintptr_t); 1798 buffer_offset = objects_start_offset + 1799 sizeof(binder_size_t) * last_bbo->parent; 1800 if (binder_alloc_copy_from_buffer(&proc->alloc, 1801 &last_obj_offset, 1802 b, buffer_offset, 1803 sizeof(last_obj_offset))) 1804 return false; 1805 } 1806 return (fixup_offset >= last_min_offset); 1807 } 1808 1809 /** 1810 * struct binder_task_work_cb - for deferred close 1811 * 1812 * @twork: callback_head for task work 1813 * @fd: fd to close 1814 * 1815 * Structure to pass task work to be handled after 1816 * returning from binder_ioctl() via task_work_add(). 1817 */ 1818 struct binder_task_work_cb { 1819 struct callback_head twork; 1820 struct file *file; 1821 }; 1822 1823 /** 1824 * binder_do_fd_close() - close list of file descriptors 1825 * @twork: callback head for task work 1826 * 1827 * It is not safe to call ksys_close() during the binder_ioctl() 1828 * function if there is a chance that binder's own file descriptor 1829 * might be closed. This is to meet the requirements for using 1830 * fdget() (see comments for __fget_light()). Therefore use 1831 * task_work_add() to schedule the close operation once we have 1832 * returned from binder_ioctl(). This function is a callback 1833 * for that mechanism and does the actual ksys_close() on the 1834 * given file descriptor. 1835 */ 1836 static void binder_do_fd_close(struct callback_head *twork) 1837 { 1838 struct binder_task_work_cb *twcb = container_of(twork, 1839 struct binder_task_work_cb, twork); 1840 1841 fput(twcb->file); 1842 kfree(twcb); 1843 } 1844 1845 /** 1846 * binder_deferred_fd_close() - schedule a close for the given file-descriptor 1847 * @fd: file-descriptor to close 1848 * 1849 * See comments in binder_do_fd_close(). This function is used to schedule 1850 * a file-descriptor to be closed after returning from binder_ioctl(). 1851 */ 1852 static void binder_deferred_fd_close(int fd) 1853 { 1854 struct binder_task_work_cb *twcb; 1855 1856 twcb = kzalloc(sizeof(*twcb), GFP_KERNEL); 1857 if (!twcb) 1858 return; 1859 init_task_work(&twcb->twork, binder_do_fd_close); 1860 close_fd_get_file(fd, &twcb->file); 1861 if (twcb->file) { 1862 filp_close(twcb->file, current->files); 1863 task_work_add(current, &twcb->twork, TWA_RESUME); 1864 } else { 1865 kfree(twcb); 1866 } 1867 } 1868 1869 static void binder_transaction_buffer_release(struct binder_proc *proc, 1870 struct binder_thread *thread, 1871 struct binder_buffer *buffer, 1872 binder_size_t failed_at, 1873 bool is_failure) 1874 { 1875 int debug_id = buffer->debug_id; 1876 binder_size_t off_start_offset, buffer_offset, off_end_offset; 1877 1878 binder_debug(BINDER_DEBUG_TRANSACTION, 1879 "%d buffer release %d, size %zd-%zd, failed at %llx\n", 1880 proc->pid, buffer->debug_id, 1881 buffer->data_size, buffer->offsets_size, 1882 (unsigned long long)failed_at); 1883 1884 if (buffer->target_node) 1885 binder_dec_node(buffer->target_node, 1, 0); 1886 1887 off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); 1888 off_end_offset = is_failure && failed_at ? failed_at : 1889 off_start_offset + buffer->offsets_size; 1890 for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; 1891 buffer_offset += sizeof(binder_size_t)) { 1892 struct binder_object_header *hdr; 1893 size_t object_size = 0; 1894 struct binder_object object; 1895 binder_size_t object_offset; 1896 1897 if (!binder_alloc_copy_from_buffer(&proc->alloc, &object_offset, 1898 buffer, buffer_offset, 1899 sizeof(object_offset))) 1900 object_size = binder_get_object(proc, NULL, buffer, 1901 object_offset, &object); 1902 if (object_size == 0) { 1903 pr_err("transaction release %d bad object at offset %lld, size %zd\n", 1904 debug_id, (u64)object_offset, buffer->data_size); 1905 continue; 1906 } 1907 hdr = &object.hdr; 1908 switch (hdr->type) { 1909 case BINDER_TYPE_BINDER: 1910 case BINDER_TYPE_WEAK_BINDER: { 1911 struct flat_binder_object *fp; 1912 struct binder_node *node; 1913 1914 fp = to_flat_binder_object(hdr); 1915 node = binder_get_node(proc, fp->binder); 1916 if (node == NULL) { 1917 pr_err("transaction release %d bad node %016llx\n", 1918 debug_id, (u64)fp->binder); 1919 break; 1920 } 1921 binder_debug(BINDER_DEBUG_TRANSACTION, 1922 " node %d u%016llx\n", 1923 node->debug_id, (u64)node->ptr); 1924 binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER, 1925 0); 1926 binder_put_node(node); 1927 } break; 1928 case BINDER_TYPE_HANDLE: 1929 case BINDER_TYPE_WEAK_HANDLE: { 1930 struct flat_binder_object *fp; 1931 struct binder_ref_data rdata; 1932 int ret; 1933 1934 fp = to_flat_binder_object(hdr); 1935 ret = binder_dec_ref_for_handle(proc, fp->handle, 1936 hdr->type == BINDER_TYPE_HANDLE, &rdata); 1937 1938 if (ret) { 1939 pr_err("transaction release %d bad handle %d, ret = %d\n", 1940 debug_id, fp->handle, ret); 1941 break; 1942 } 1943 binder_debug(BINDER_DEBUG_TRANSACTION, 1944 " ref %d desc %d\n", 1945 rdata.debug_id, rdata.desc); 1946 } break; 1947 1948 case BINDER_TYPE_FD: { 1949 /* 1950 * No need to close the file here since user-space 1951 * closes it for successfully delivered 1952 * transactions. For transactions that weren't 1953 * delivered, the new fd was never allocated so 1954 * there is no need to close and the fput on the 1955 * file is done when the transaction is torn 1956 * down. 1957 */ 1958 } break; 1959 case BINDER_TYPE_PTR: 1960 /* 1961 * Nothing to do here, this will get cleaned up when the 1962 * transaction buffer gets freed 1963 */ 1964 break; 1965 case BINDER_TYPE_FDA: { 1966 struct binder_fd_array_object *fda; 1967 struct binder_buffer_object *parent; 1968 struct binder_object ptr_object; 1969 binder_size_t fda_offset; 1970 size_t fd_index; 1971 binder_size_t fd_buf_size; 1972 binder_size_t num_valid; 1973 1974 if (is_failure) { 1975 /* 1976 * The fd fixups have not been applied so no 1977 * fds need to be closed. 1978 */ 1979 continue; 1980 } 1981 1982 num_valid = (buffer_offset - off_start_offset) / 1983 sizeof(binder_size_t); 1984 fda = to_binder_fd_array_object(hdr); 1985 parent = binder_validate_ptr(proc, buffer, &ptr_object, 1986 fda->parent, 1987 off_start_offset, 1988 NULL, 1989 num_valid); 1990 if (!parent) { 1991 pr_err("transaction release %d bad parent offset\n", 1992 debug_id); 1993 continue; 1994 } 1995 fd_buf_size = sizeof(u32) * fda->num_fds; 1996 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { 1997 pr_err("transaction release %d invalid number of fds (%lld)\n", 1998 debug_id, (u64)fda->num_fds); 1999 continue; 2000 } 2001 if (fd_buf_size > parent->length || 2002 fda->parent_offset > parent->length - fd_buf_size) { 2003 /* No space for all file descriptors here. */ 2004 pr_err("transaction release %d not enough space for %lld fds in buffer\n", 2005 debug_id, (u64)fda->num_fds); 2006 continue; 2007 } 2008 /* 2009 * the source data for binder_buffer_object is visible 2010 * to user-space and the @buffer element is the user 2011 * pointer to the buffer_object containing the fd_array. 2012 * Convert the address to an offset relative to 2013 * the base of the transaction buffer. 2014 */ 2015 fda_offset = 2016 (parent->buffer - (uintptr_t)buffer->user_data) + 2017 fda->parent_offset; 2018 for (fd_index = 0; fd_index < fda->num_fds; 2019 fd_index++) { 2020 u32 fd; 2021 int err; 2022 binder_size_t offset = fda_offset + 2023 fd_index * sizeof(fd); 2024 2025 err = binder_alloc_copy_from_buffer( 2026 &proc->alloc, &fd, buffer, 2027 offset, sizeof(fd)); 2028 WARN_ON(err); 2029 if (!err) { 2030 binder_deferred_fd_close(fd); 2031 /* 2032 * Need to make sure the thread goes 2033 * back to userspace to complete the 2034 * deferred close 2035 */ 2036 if (thread) 2037 thread->looper_need_return = true; 2038 } 2039 } 2040 } break; 2041 default: 2042 pr_err("transaction release %d bad object type %x\n", 2043 debug_id, hdr->type); 2044 break; 2045 } 2046 } 2047 } 2048 2049 static int binder_translate_binder(struct flat_binder_object *fp, 2050 struct binder_transaction *t, 2051 struct binder_thread *thread) 2052 { 2053 struct binder_node *node; 2054 struct binder_proc *proc = thread->proc; 2055 struct binder_proc *target_proc = t->to_proc; 2056 struct binder_ref_data rdata; 2057 int ret = 0; 2058 2059 node = binder_get_node(proc, fp->binder); 2060 if (!node) { 2061 node = binder_new_node(proc, fp); 2062 if (!node) 2063 return -ENOMEM; 2064 } 2065 if (fp->cookie != node->cookie) { 2066 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n", 2067 proc->pid, thread->pid, (u64)fp->binder, 2068 node->debug_id, (u64)fp->cookie, 2069 (u64)node->cookie); 2070 ret = -EINVAL; 2071 goto done; 2072 } 2073 if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { 2074 ret = -EPERM; 2075 goto done; 2076 } 2077 2078 ret = binder_inc_ref_for_node(target_proc, node, 2079 fp->hdr.type == BINDER_TYPE_BINDER, 2080 &thread->todo, &rdata); 2081 if (ret) 2082 goto done; 2083 2084 if (fp->hdr.type == BINDER_TYPE_BINDER) 2085 fp->hdr.type = BINDER_TYPE_HANDLE; 2086 else 2087 fp->hdr.type = BINDER_TYPE_WEAK_HANDLE; 2088 fp->binder = 0; 2089 fp->handle = rdata.desc; 2090 fp->cookie = 0; 2091 2092 trace_binder_transaction_node_to_ref(t, node, &rdata); 2093 binder_debug(BINDER_DEBUG_TRANSACTION, 2094 " node %d u%016llx -> ref %d desc %d\n", 2095 node->debug_id, (u64)node->ptr, 2096 rdata.debug_id, rdata.desc); 2097 done: 2098 binder_put_node(node); 2099 return ret; 2100 } 2101 2102 static int binder_translate_handle(struct flat_binder_object *fp, 2103 struct binder_transaction *t, 2104 struct binder_thread *thread) 2105 { 2106 struct binder_proc *proc = thread->proc; 2107 struct binder_proc *target_proc = t->to_proc; 2108 struct binder_node *node; 2109 struct binder_ref_data src_rdata; 2110 int ret = 0; 2111 2112 node = binder_get_node_from_ref(proc, fp->handle, 2113 fp->hdr.type == BINDER_TYPE_HANDLE, &src_rdata); 2114 if (!node) { 2115 binder_user_error("%d:%d got transaction with invalid handle, %d\n", 2116 proc->pid, thread->pid, fp->handle); 2117 return -EINVAL; 2118 } 2119 if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { 2120 ret = -EPERM; 2121 goto done; 2122 } 2123 2124 binder_node_lock(node); 2125 if (node->proc == target_proc) { 2126 if (fp->hdr.type == BINDER_TYPE_HANDLE) 2127 fp->hdr.type = BINDER_TYPE_BINDER; 2128 else 2129 fp->hdr.type = BINDER_TYPE_WEAK_BINDER; 2130 fp->binder = node->ptr; 2131 fp->cookie = node->cookie; 2132 if (node->proc) 2133 binder_inner_proc_lock(node->proc); 2134 else 2135 __acquire(&node->proc->inner_lock); 2136 binder_inc_node_nilocked(node, 2137 fp->hdr.type == BINDER_TYPE_BINDER, 2138 0, NULL); 2139 if (node->proc) 2140 binder_inner_proc_unlock(node->proc); 2141 else 2142 __release(&node->proc->inner_lock); 2143 trace_binder_transaction_ref_to_node(t, node, &src_rdata); 2144 binder_debug(BINDER_DEBUG_TRANSACTION, 2145 " ref %d desc %d -> node %d u%016llx\n", 2146 src_rdata.debug_id, src_rdata.desc, node->debug_id, 2147 (u64)node->ptr); 2148 binder_node_unlock(node); 2149 } else { 2150 struct binder_ref_data dest_rdata; 2151 2152 binder_node_unlock(node); 2153 ret = binder_inc_ref_for_node(target_proc, node, 2154 fp->hdr.type == BINDER_TYPE_HANDLE, 2155 NULL, &dest_rdata); 2156 if (ret) 2157 goto done; 2158 2159 fp->binder = 0; 2160 fp->handle = dest_rdata.desc; 2161 fp->cookie = 0; 2162 trace_binder_transaction_ref_to_ref(t, node, &src_rdata, 2163 &dest_rdata); 2164 binder_debug(BINDER_DEBUG_TRANSACTION, 2165 " ref %d desc %d -> ref %d desc %d (node %d)\n", 2166 src_rdata.debug_id, src_rdata.desc, 2167 dest_rdata.debug_id, dest_rdata.desc, 2168 node->debug_id); 2169 } 2170 done: 2171 binder_put_node(node); 2172 return ret; 2173 } 2174 2175 static int binder_translate_fd(u32 fd, binder_size_t fd_offset, 2176 struct binder_transaction *t, 2177 struct binder_thread *thread, 2178 struct binder_transaction *in_reply_to) 2179 { 2180 struct binder_proc *proc = thread->proc; 2181 struct binder_proc *target_proc = t->to_proc; 2182 struct binder_txn_fd_fixup *fixup; 2183 struct file *file; 2184 int ret = 0; 2185 bool target_allows_fd; 2186 2187 if (in_reply_to) 2188 target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS); 2189 else 2190 target_allows_fd = t->buffer->target_node->accept_fds; 2191 if (!target_allows_fd) { 2192 binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n", 2193 proc->pid, thread->pid, 2194 in_reply_to ? "reply" : "transaction", 2195 fd); 2196 ret = -EPERM; 2197 goto err_fd_not_accepted; 2198 } 2199 2200 file = fget(fd); 2201 if (!file) { 2202 binder_user_error("%d:%d got transaction with invalid fd, %d\n", 2203 proc->pid, thread->pid, fd); 2204 ret = -EBADF; 2205 goto err_fget; 2206 } 2207 ret = security_binder_transfer_file(proc->cred, target_proc->cred, file); 2208 if (ret < 0) { 2209 ret = -EPERM; 2210 goto err_security; 2211 } 2212 2213 /* 2214 * Add fixup record for this transaction. The allocation 2215 * of the fd in the target needs to be done from a 2216 * target thread. 2217 */ 2218 fixup = kzalloc(sizeof(*fixup), GFP_KERNEL); 2219 if (!fixup) { 2220 ret = -ENOMEM; 2221 goto err_alloc; 2222 } 2223 fixup->file = file; 2224 fixup->offset = fd_offset; 2225 fixup->target_fd = -1; 2226 trace_binder_transaction_fd_send(t, fd, fixup->offset); 2227 list_add_tail(&fixup->fixup_entry, &t->fd_fixups); 2228 2229 return ret; 2230 2231 err_alloc: 2232 err_security: 2233 fput(file); 2234 err_fget: 2235 err_fd_not_accepted: 2236 return ret; 2237 } 2238 2239 /** 2240 * struct binder_ptr_fixup - data to be fixed-up in target buffer 2241 * @offset offset in target buffer to fixup 2242 * @skip_size bytes to skip in copy (fixup will be written later) 2243 * @fixup_data data to write at fixup offset 2244 * @node list node 2245 * 2246 * This is used for the pointer fixup list (pf) which is created and consumed 2247 * during binder_transaction() and is only accessed locally. No 2248 * locking is necessary. 2249 * 2250 * The list is ordered by @offset. 2251 */ 2252 struct binder_ptr_fixup { 2253 binder_size_t offset; 2254 size_t skip_size; 2255 binder_uintptr_t fixup_data; 2256 struct list_head node; 2257 }; 2258 2259 /** 2260 * struct binder_sg_copy - scatter-gather data to be copied 2261 * @offset offset in target buffer 2262 * @sender_uaddr user address in source buffer 2263 * @length bytes to copy 2264 * @node list node 2265 * 2266 * This is used for the sg copy list (sgc) which is created and consumed 2267 * during binder_transaction() and is only accessed locally. No 2268 * locking is necessary. 2269 * 2270 * The list is ordered by @offset. 2271 */ 2272 struct binder_sg_copy { 2273 binder_size_t offset; 2274 const void __user *sender_uaddr; 2275 size_t length; 2276 struct list_head node; 2277 }; 2278 2279 /** 2280 * binder_do_deferred_txn_copies() - copy and fixup scatter-gather data 2281 * @alloc: binder_alloc associated with @buffer 2282 * @buffer: binder buffer in target process 2283 * @sgc_head: list_head of scatter-gather copy list 2284 * @pf_head: list_head of pointer fixup list 2285 * 2286 * Processes all elements of @sgc_head, applying fixups from @pf_head 2287 * and copying the scatter-gather data from the source process' user 2288 * buffer to the target's buffer. It is expected that the list creation 2289 * and processing all occurs during binder_transaction() so these lists 2290 * are only accessed in local context. 2291 * 2292 * Return: 0=success, else -errno 2293 */ 2294 static int binder_do_deferred_txn_copies(struct binder_alloc *alloc, 2295 struct binder_buffer *buffer, 2296 struct list_head *sgc_head, 2297 struct list_head *pf_head) 2298 { 2299 int ret = 0; 2300 struct binder_sg_copy *sgc, *tmpsgc; 2301 struct binder_ptr_fixup *tmppf; 2302 struct binder_ptr_fixup *pf = 2303 list_first_entry_or_null(pf_head, struct binder_ptr_fixup, 2304 node); 2305 2306 list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) { 2307 size_t bytes_copied = 0; 2308 2309 while (bytes_copied < sgc->length) { 2310 size_t copy_size; 2311 size_t bytes_left = sgc->length - bytes_copied; 2312 size_t offset = sgc->offset + bytes_copied; 2313 2314 /* 2315 * We copy up to the fixup (pointed to by pf) 2316 */ 2317 copy_size = pf ? min(bytes_left, (size_t)pf->offset - offset) 2318 : bytes_left; 2319 if (!ret && copy_size) 2320 ret = binder_alloc_copy_user_to_buffer( 2321 alloc, buffer, 2322 offset, 2323 sgc->sender_uaddr + bytes_copied, 2324 copy_size); 2325 bytes_copied += copy_size; 2326 if (copy_size != bytes_left) { 2327 BUG_ON(!pf); 2328 /* we stopped at a fixup offset */ 2329 if (pf->skip_size) { 2330 /* 2331 * we are just skipping. This is for 2332 * BINDER_TYPE_FDA where the translated 2333 * fds will be fixed up when we get 2334 * to target context. 2335 */ 2336 bytes_copied += pf->skip_size; 2337 } else { 2338 /* apply the fixup indicated by pf */ 2339 if (!ret) 2340 ret = binder_alloc_copy_to_buffer( 2341 alloc, buffer, 2342 pf->offset, 2343 &pf->fixup_data, 2344 sizeof(pf->fixup_data)); 2345 bytes_copied += sizeof(pf->fixup_data); 2346 } 2347 list_del(&pf->node); 2348 kfree(pf); 2349 pf = list_first_entry_or_null(pf_head, 2350 struct binder_ptr_fixup, node); 2351 } 2352 } 2353 list_del(&sgc->node); 2354 kfree(sgc); 2355 } 2356 list_for_each_entry_safe(pf, tmppf, pf_head, node) { 2357 BUG_ON(pf->skip_size == 0); 2358 list_del(&pf->node); 2359 kfree(pf); 2360 } 2361 BUG_ON(!list_empty(sgc_head)); 2362 2363 return ret > 0 ? -EINVAL : ret; 2364 } 2365 2366 /** 2367 * binder_cleanup_deferred_txn_lists() - free specified lists 2368 * @sgc_head: list_head of scatter-gather copy list 2369 * @pf_head: list_head of pointer fixup list 2370 * 2371 * Called to clean up @sgc_head and @pf_head if there is an 2372 * error. 2373 */ 2374 static void binder_cleanup_deferred_txn_lists(struct list_head *sgc_head, 2375 struct list_head *pf_head) 2376 { 2377 struct binder_sg_copy *sgc, *tmpsgc; 2378 struct binder_ptr_fixup *pf, *tmppf; 2379 2380 list_for_each_entry_safe(sgc, tmpsgc, sgc_head, node) { 2381 list_del(&sgc->node); 2382 kfree(sgc); 2383 } 2384 list_for_each_entry_safe(pf, tmppf, pf_head, node) { 2385 list_del(&pf->node); 2386 kfree(pf); 2387 } 2388 } 2389 2390 /** 2391 * binder_defer_copy() - queue a scatter-gather buffer for copy 2392 * @sgc_head: list_head of scatter-gather copy list 2393 * @offset: binder buffer offset in target process 2394 * @sender_uaddr: user address in source process 2395 * @length: bytes to copy 2396 * 2397 * Specify a scatter-gather block to be copied. The actual copy must 2398 * be deferred until all the needed fixups are identified and queued. 2399 * Then the copy and fixups are done together so un-translated values 2400 * from the source are never visible in the target buffer. 2401 * 2402 * We are guaranteed that repeated calls to this function will have 2403 * monotonically increasing @offset values so the list will naturally 2404 * be ordered. 2405 * 2406 * Return: 0=success, else -errno 2407 */ 2408 static int binder_defer_copy(struct list_head *sgc_head, binder_size_t offset, 2409 const void __user *sender_uaddr, size_t length) 2410 { 2411 struct binder_sg_copy *bc = kzalloc(sizeof(*bc), GFP_KERNEL); 2412 2413 if (!bc) 2414 return -ENOMEM; 2415 2416 bc->offset = offset; 2417 bc->sender_uaddr = sender_uaddr; 2418 bc->length = length; 2419 INIT_LIST_HEAD(&bc->node); 2420 2421 /* 2422 * We are guaranteed that the deferred copies are in-order 2423 * so just add to the tail. 2424 */ 2425 list_add_tail(&bc->node, sgc_head); 2426 2427 return 0; 2428 } 2429 2430 /** 2431 * binder_add_fixup() - queue a fixup to be applied to sg copy 2432 * @pf_head: list_head of binder ptr fixup list 2433 * @offset: binder buffer offset in target process 2434 * @fixup: bytes to be copied for fixup 2435 * @skip_size: bytes to skip when copying (fixup will be applied later) 2436 * 2437 * Add the specified fixup to a list ordered by @offset. When copying 2438 * the scatter-gather buffers, the fixup will be copied instead of 2439 * data from the source buffer. For BINDER_TYPE_FDA fixups, the fixup 2440 * will be applied later (in target process context), so we just skip 2441 * the bytes specified by @skip_size. If @skip_size is 0, we copy the 2442 * value in @fixup. 2443 * 2444 * This function is called *mostly* in @offset order, but there are 2445 * exceptions. Since out-of-order inserts are relatively uncommon, 2446 * we insert the new element by searching backward from the tail of 2447 * the list. 2448 * 2449 * Return: 0=success, else -errno 2450 */ 2451 static int binder_add_fixup(struct list_head *pf_head, binder_size_t offset, 2452 binder_uintptr_t fixup, size_t skip_size) 2453 { 2454 struct binder_ptr_fixup *pf = kzalloc(sizeof(*pf), GFP_KERNEL); 2455 struct binder_ptr_fixup *tmppf; 2456 2457 if (!pf) 2458 return -ENOMEM; 2459 2460 pf->offset = offset; 2461 pf->fixup_data = fixup; 2462 pf->skip_size = skip_size; 2463 INIT_LIST_HEAD(&pf->node); 2464 2465 /* Fixups are *mostly* added in-order, but there are some 2466 * exceptions. Look backwards through list for insertion point. 2467 */ 2468 list_for_each_entry_reverse(tmppf, pf_head, node) { 2469 if (tmppf->offset < pf->offset) { 2470 list_add(&pf->node, &tmppf->node); 2471 return 0; 2472 } 2473 } 2474 /* 2475 * if we get here, then the new offset is the lowest so 2476 * insert at the head 2477 */ 2478 list_add(&pf->node, pf_head); 2479 return 0; 2480 } 2481 2482 static int binder_translate_fd_array(struct list_head *pf_head, 2483 struct binder_fd_array_object *fda, 2484 const void __user *sender_ubuffer, 2485 struct binder_buffer_object *parent, 2486 struct binder_buffer_object *sender_uparent, 2487 struct binder_transaction *t, 2488 struct binder_thread *thread, 2489 struct binder_transaction *in_reply_to) 2490 { 2491 binder_size_t fdi, fd_buf_size; 2492 binder_size_t fda_offset; 2493 const void __user *sender_ufda_base; 2494 struct binder_proc *proc = thread->proc; 2495 int ret; 2496 2497 if (fda->num_fds == 0) 2498 return 0; 2499 2500 fd_buf_size = sizeof(u32) * fda->num_fds; 2501 if (fda->num_fds >= SIZE_MAX / sizeof(u32)) { 2502 binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n", 2503 proc->pid, thread->pid, (u64)fda->num_fds); 2504 return -EINVAL; 2505 } 2506 if (fd_buf_size > parent->length || 2507 fda->parent_offset > parent->length - fd_buf_size) { 2508 /* No space for all file descriptors here. */ 2509 binder_user_error("%d:%d not enough space to store %lld fds in buffer\n", 2510 proc->pid, thread->pid, (u64)fda->num_fds); 2511 return -EINVAL; 2512 } 2513 /* 2514 * the source data for binder_buffer_object is visible 2515 * to user-space and the @buffer element is the user 2516 * pointer to the buffer_object containing the fd_array. 2517 * Convert the address to an offset relative to 2518 * the base of the transaction buffer. 2519 */ 2520 fda_offset = (parent->buffer - (uintptr_t)t->buffer->user_data) + 2521 fda->parent_offset; 2522 sender_ufda_base = (void __user *)(uintptr_t)sender_uparent->buffer + 2523 fda->parent_offset; 2524 2525 if (!IS_ALIGNED((unsigned long)fda_offset, sizeof(u32)) || 2526 !IS_ALIGNED((unsigned long)sender_ufda_base, sizeof(u32))) { 2527 binder_user_error("%d:%d parent offset not aligned correctly.\n", 2528 proc->pid, thread->pid); 2529 return -EINVAL; 2530 } 2531 ret = binder_add_fixup(pf_head, fda_offset, 0, fda->num_fds * sizeof(u32)); 2532 if (ret) 2533 return ret; 2534 2535 for (fdi = 0; fdi < fda->num_fds; fdi++) { 2536 u32 fd; 2537 binder_size_t offset = fda_offset + fdi * sizeof(fd); 2538 binder_size_t sender_uoffset = fdi * sizeof(fd); 2539 2540 ret = copy_from_user(&fd, sender_ufda_base + sender_uoffset, sizeof(fd)); 2541 if (!ret) 2542 ret = binder_translate_fd(fd, offset, t, thread, 2543 in_reply_to); 2544 if (ret) 2545 return ret > 0 ? -EINVAL : ret; 2546 } 2547 return 0; 2548 } 2549 2550 static int binder_fixup_parent(struct list_head *pf_head, 2551 struct binder_transaction *t, 2552 struct binder_thread *thread, 2553 struct binder_buffer_object *bp, 2554 binder_size_t off_start_offset, 2555 binder_size_t num_valid, 2556 binder_size_t last_fixup_obj_off, 2557 binder_size_t last_fixup_min_off) 2558 { 2559 struct binder_buffer_object *parent; 2560 struct binder_buffer *b = t->buffer; 2561 struct binder_proc *proc = thread->proc; 2562 struct binder_proc *target_proc = t->to_proc; 2563 struct binder_object object; 2564 binder_size_t buffer_offset; 2565 binder_size_t parent_offset; 2566 2567 if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT)) 2568 return 0; 2569 2570 parent = binder_validate_ptr(target_proc, b, &object, bp->parent, 2571 off_start_offset, &parent_offset, 2572 num_valid); 2573 if (!parent) { 2574 binder_user_error("%d:%d got transaction with invalid parent offset or type\n", 2575 proc->pid, thread->pid); 2576 return -EINVAL; 2577 } 2578 2579 if (!binder_validate_fixup(target_proc, b, off_start_offset, 2580 parent_offset, bp->parent_offset, 2581 last_fixup_obj_off, 2582 last_fixup_min_off)) { 2583 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n", 2584 proc->pid, thread->pid); 2585 return -EINVAL; 2586 } 2587 2588 if (parent->length < sizeof(binder_uintptr_t) || 2589 bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) { 2590 /* No space for a pointer here! */ 2591 binder_user_error("%d:%d got transaction with invalid parent offset\n", 2592 proc->pid, thread->pid); 2593 return -EINVAL; 2594 } 2595 buffer_offset = bp->parent_offset + 2596 (uintptr_t)parent->buffer - (uintptr_t)b->user_data; 2597 return binder_add_fixup(pf_head, buffer_offset, bp->buffer, 0); 2598 } 2599 2600 /** 2601 * binder_proc_transaction() - sends a transaction to a process and wakes it up 2602 * @t: transaction to send 2603 * @proc: process to send the transaction to 2604 * @thread: thread in @proc to send the transaction to (may be NULL) 2605 * 2606 * This function queues a transaction to the specified process. It will try 2607 * to find a thread in the target process to handle the transaction and 2608 * wake it up. If no thread is found, the work is queued to the proc 2609 * waitqueue. 2610 * 2611 * If the @thread parameter is not NULL, the transaction is always queued 2612 * to the waitlist of that specific thread. 2613 * 2614 * Return: 0 if the transaction was successfully queued 2615 * BR_DEAD_REPLY if the target process or thread is dead 2616 * BR_FROZEN_REPLY if the target process or thread is frozen 2617 */ 2618 static int binder_proc_transaction(struct binder_transaction *t, 2619 struct binder_proc *proc, 2620 struct binder_thread *thread) 2621 { 2622 struct binder_node *node = t->buffer->target_node; 2623 bool oneway = !!(t->flags & TF_ONE_WAY); 2624 bool pending_async = false; 2625 2626 BUG_ON(!node); 2627 binder_node_lock(node); 2628 if (oneway) { 2629 BUG_ON(thread); 2630 if (node->has_async_transaction) 2631 pending_async = true; 2632 else 2633 node->has_async_transaction = true; 2634 } 2635 2636 binder_inner_proc_lock(proc); 2637 if (proc->is_frozen) { 2638 proc->sync_recv |= !oneway; 2639 proc->async_recv |= oneway; 2640 } 2641 2642 if ((proc->is_frozen && !oneway) || proc->is_dead || 2643 (thread && thread->is_dead)) { 2644 binder_inner_proc_unlock(proc); 2645 binder_node_unlock(node); 2646 return proc->is_frozen ? BR_FROZEN_REPLY : BR_DEAD_REPLY; 2647 } 2648 2649 if (!thread && !pending_async) 2650 thread = binder_select_thread_ilocked(proc); 2651 2652 if (thread) 2653 binder_enqueue_thread_work_ilocked(thread, &t->work); 2654 else if (!pending_async) 2655 binder_enqueue_work_ilocked(&t->work, &proc->todo); 2656 else 2657 binder_enqueue_work_ilocked(&t->work, &node->async_todo); 2658 2659 if (!pending_async) 2660 binder_wakeup_thread_ilocked(proc, thread, !oneway /* sync */); 2661 2662 proc->outstanding_txns++; 2663 binder_inner_proc_unlock(proc); 2664 binder_node_unlock(node); 2665 2666 return 0; 2667 } 2668 2669 /** 2670 * binder_get_node_refs_for_txn() - Get required refs on node for txn 2671 * @node: struct binder_node for which to get refs 2672 * @proc: returns @node->proc if valid 2673 * @error: if no @proc then returns BR_DEAD_REPLY 2674 * 2675 * User-space normally keeps the node alive when creating a transaction 2676 * since it has a reference to the target. The local strong ref keeps it 2677 * alive if the sending process dies before the target process processes 2678 * the transaction. If the source process is malicious or has a reference 2679 * counting bug, relying on the local strong ref can fail. 2680 * 2681 * Since user-space can cause the local strong ref to go away, we also take 2682 * a tmpref on the node to ensure it survives while we are constructing 2683 * the transaction. We also need a tmpref on the proc while we are 2684 * constructing the transaction, so we take that here as well. 2685 * 2686 * Return: The target_node with refs taken or NULL if no @node->proc is NULL. 2687 * Also sets @proc if valid. If the @node->proc is NULL indicating that the 2688 * target proc has died, @error is set to BR_DEAD_REPLY 2689 */ 2690 static struct binder_node *binder_get_node_refs_for_txn( 2691 struct binder_node *node, 2692 struct binder_proc **procp, 2693 uint32_t *error) 2694 { 2695 struct binder_node *target_node = NULL; 2696 2697 binder_node_inner_lock(node); 2698 if (node->proc) { 2699 target_node = node; 2700 binder_inc_node_nilocked(node, 1, 0, NULL); 2701 binder_inc_node_tmpref_ilocked(node); 2702 node->proc->tmp_ref++; 2703 *procp = node->proc; 2704 } else 2705 *error = BR_DEAD_REPLY; 2706 binder_node_inner_unlock(node); 2707 2708 return target_node; 2709 } 2710 2711 static void binder_transaction(struct binder_proc *proc, 2712 struct binder_thread *thread, 2713 struct binder_transaction_data *tr, int reply, 2714 binder_size_t extra_buffers_size) 2715 { 2716 int ret; 2717 struct binder_transaction *t; 2718 struct binder_work *w; 2719 struct binder_work *tcomplete; 2720 binder_size_t buffer_offset = 0; 2721 binder_size_t off_start_offset, off_end_offset; 2722 binder_size_t off_min; 2723 binder_size_t sg_buf_offset, sg_buf_end_offset; 2724 binder_size_t user_offset = 0; 2725 struct binder_proc *target_proc = NULL; 2726 struct binder_thread *target_thread = NULL; 2727 struct binder_node *target_node = NULL; 2728 struct binder_transaction *in_reply_to = NULL; 2729 struct binder_transaction_log_entry *e; 2730 uint32_t return_error = 0; 2731 uint32_t return_error_param = 0; 2732 uint32_t return_error_line = 0; 2733 binder_size_t last_fixup_obj_off = 0; 2734 binder_size_t last_fixup_min_off = 0; 2735 struct binder_context *context = proc->context; 2736 int t_debug_id = atomic_inc_return(&binder_last_id); 2737 char *secctx = NULL; 2738 u32 secctx_sz = 0; 2739 struct list_head sgc_head; 2740 struct list_head pf_head; 2741 const void __user *user_buffer = (const void __user *) 2742 (uintptr_t)tr->data.ptr.buffer; 2743 INIT_LIST_HEAD(&sgc_head); 2744 INIT_LIST_HEAD(&pf_head); 2745 2746 e = binder_transaction_log_add(&binder_transaction_log); 2747 e->debug_id = t_debug_id; 2748 e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY); 2749 e->from_proc = proc->pid; 2750 e->from_thread = thread->pid; 2751 e->target_handle = tr->target.handle; 2752 e->data_size = tr->data_size; 2753 e->offsets_size = tr->offsets_size; 2754 strscpy(e->context_name, proc->context->name, BINDERFS_MAX_NAME); 2755 2756 if (reply) { 2757 binder_inner_proc_lock(proc); 2758 in_reply_to = thread->transaction_stack; 2759 if (in_reply_to == NULL) { 2760 binder_inner_proc_unlock(proc); 2761 binder_user_error("%d:%d got reply transaction with no transaction stack\n", 2762 proc->pid, thread->pid); 2763 return_error = BR_FAILED_REPLY; 2764 return_error_param = -EPROTO; 2765 return_error_line = __LINE__; 2766 goto err_empty_call_stack; 2767 } 2768 if (in_reply_to->to_thread != thread) { 2769 spin_lock(&in_reply_to->lock); 2770 binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n", 2771 proc->pid, thread->pid, in_reply_to->debug_id, 2772 in_reply_to->to_proc ? 2773 in_reply_to->to_proc->pid : 0, 2774 in_reply_to->to_thread ? 2775 in_reply_to->to_thread->pid : 0); 2776 spin_unlock(&in_reply_to->lock); 2777 binder_inner_proc_unlock(proc); 2778 return_error = BR_FAILED_REPLY; 2779 return_error_param = -EPROTO; 2780 return_error_line = __LINE__; 2781 in_reply_to = NULL; 2782 goto err_bad_call_stack; 2783 } 2784 thread->transaction_stack = in_reply_to->to_parent; 2785 binder_inner_proc_unlock(proc); 2786 binder_set_nice(in_reply_to->saved_priority); 2787 target_thread = binder_get_txn_from_and_acq_inner(in_reply_to); 2788 if (target_thread == NULL) { 2789 /* annotation for sparse */ 2790 __release(&target_thread->proc->inner_lock); 2791 return_error = BR_DEAD_REPLY; 2792 return_error_line = __LINE__; 2793 goto err_dead_binder; 2794 } 2795 if (target_thread->transaction_stack != in_reply_to) { 2796 binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n", 2797 proc->pid, thread->pid, 2798 target_thread->transaction_stack ? 2799 target_thread->transaction_stack->debug_id : 0, 2800 in_reply_to->debug_id); 2801 binder_inner_proc_unlock(target_thread->proc); 2802 return_error = BR_FAILED_REPLY; 2803 return_error_param = -EPROTO; 2804 return_error_line = __LINE__; 2805 in_reply_to = NULL; 2806 target_thread = NULL; 2807 goto err_dead_binder; 2808 } 2809 target_proc = target_thread->proc; 2810 target_proc->tmp_ref++; 2811 binder_inner_proc_unlock(target_thread->proc); 2812 } else { 2813 if (tr->target.handle) { 2814 struct binder_ref *ref; 2815 2816 /* 2817 * There must already be a strong ref 2818 * on this node. If so, do a strong 2819 * increment on the node to ensure it 2820 * stays alive until the transaction is 2821 * done. 2822 */ 2823 binder_proc_lock(proc); 2824 ref = binder_get_ref_olocked(proc, tr->target.handle, 2825 true); 2826 if (ref) { 2827 target_node = binder_get_node_refs_for_txn( 2828 ref->node, &target_proc, 2829 &return_error); 2830 } else { 2831 binder_user_error("%d:%d got transaction to invalid handle, %u\n", 2832 proc->pid, thread->pid, tr->target.handle); 2833 return_error = BR_FAILED_REPLY; 2834 } 2835 binder_proc_unlock(proc); 2836 } else { 2837 mutex_lock(&context->context_mgr_node_lock); 2838 target_node = context->binder_context_mgr_node; 2839 if (target_node) 2840 target_node = binder_get_node_refs_for_txn( 2841 target_node, &target_proc, 2842 &return_error); 2843 else 2844 return_error = BR_DEAD_REPLY; 2845 mutex_unlock(&context->context_mgr_node_lock); 2846 if (target_node && target_proc->pid == proc->pid) { 2847 binder_user_error("%d:%d got transaction to context manager from process owning it\n", 2848 proc->pid, thread->pid); 2849 return_error = BR_FAILED_REPLY; 2850 return_error_param = -EINVAL; 2851 return_error_line = __LINE__; 2852 goto err_invalid_target_handle; 2853 } 2854 } 2855 if (!target_node) { 2856 /* 2857 * return_error is set above 2858 */ 2859 return_error_param = -EINVAL; 2860 return_error_line = __LINE__; 2861 goto err_dead_binder; 2862 } 2863 e->to_node = target_node->debug_id; 2864 if (WARN_ON(proc == target_proc)) { 2865 return_error = BR_FAILED_REPLY; 2866 return_error_param = -EINVAL; 2867 return_error_line = __LINE__; 2868 goto err_invalid_target_handle; 2869 } 2870 if (security_binder_transaction(proc->cred, 2871 target_proc->cred) < 0) { 2872 return_error = BR_FAILED_REPLY; 2873 return_error_param = -EPERM; 2874 return_error_line = __LINE__; 2875 goto err_invalid_target_handle; 2876 } 2877 binder_inner_proc_lock(proc); 2878 2879 w = list_first_entry_or_null(&thread->todo, 2880 struct binder_work, entry); 2881 if (!(tr->flags & TF_ONE_WAY) && w && 2882 w->type == BINDER_WORK_TRANSACTION) { 2883 /* 2884 * Do not allow new outgoing transaction from a 2885 * thread that has a transaction at the head of 2886 * its todo list. Only need to check the head 2887 * because binder_select_thread_ilocked picks a 2888 * thread from proc->waiting_threads to enqueue 2889 * the transaction, and nothing is queued to the 2890 * todo list while the thread is on waiting_threads. 2891 */ 2892 binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n", 2893 proc->pid, thread->pid); 2894 binder_inner_proc_unlock(proc); 2895 return_error = BR_FAILED_REPLY; 2896 return_error_param = -EPROTO; 2897 return_error_line = __LINE__; 2898 goto err_bad_todo_list; 2899 } 2900 2901 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) { 2902 struct binder_transaction *tmp; 2903 2904 tmp = thread->transaction_stack; 2905 if (tmp->to_thread != thread) { 2906 spin_lock(&tmp->lock); 2907 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n", 2908 proc->pid, thread->pid, tmp->debug_id, 2909 tmp->to_proc ? tmp->to_proc->pid : 0, 2910 tmp->to_thread ? 2911 tmp->to_thread->pid : 0); 2912 spin_unlock(&tmp->lock); 2913 binder_inner_proc_unlock(proc); 2914 return_error = BR_FAILED_REPLY; 2915 return_error_param = -EPROTO; 2916 return_error_line = __LINE__; 2917 goto err_bad_call_stack; 2918 } 2919 while (tmp) { 2920 struct binder_thread *from; 2921 2922 spin_lock(&tmp->lock); 2923 from = tmp->from; 2924 if (from && from->proc == target_proc) { 2925 atomic_inc(&from->tmp_ref); 2926 target_thread = from; 2927 spin_unlock(&tmp->lock); 2928 break; 2929 } 2930 spin_unlock(&tmp->lock); 2931 tmp = tmp->from_parent; 2932 } 2933 } 2934 binder_inner_proc_unlock(proc); 2935 } 2936 if (target_thread) 2937 e->to_thread = target_thread->pid; 2938 e->to_proc = target_proc->pid; 2939 2940 /* TODO: reuse incoming transaction for reply */ 2941 t = kzalloc(sizeof(*t), GFP_KERNEL); 2942 if (t == NULL) { 2943 return_error = BR_FAILED_REPLY; 2944 return_error_param = -ENOMEM; 2945 return_error_line = __LINE__; 2946 goto err_alloc_t_failed; 2947 } 2948 INIT_LIST_HEAD(&t->fd_fixups); 2949 binder_stats_created(BINDER_STAT_TRANSACTION); 2950 spin_lock_init(&t->lock); 2951 2952 tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL); 2953 if (tcomplete == NULL) { 2954 return_error = BR_FAILED_REPLY; 2955 return_error_param = -ENOMEM; 2956 return_error_line = __LINE__; 2957 goto err_alloc_tcomplete_failed; 2958 } 2959 binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE); 2960 2961 t->debug_id = t_debug_id; 2962 2963 if (reply) 2964 binder_debug(BINDER_DEBUG_TRANSACTION, 2965 "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n", 2966 proc->pid, thread->pid, t->debug_id, 2967 target_proc->pid, target_thread->pid, 2968 (u64)tr->data.ptr.buffer, 2969 (u64)tr->data.ptr.offsets, 2970 (u64)tr->data_size, (u64)tr->offsets_size, 2971 (u64)extra_buffers_size); 2972 else 2973 binder_debug(BINDER_DEBUG_TRANSACTION, 2974 "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n", 2975 proc->pid, thread->pid, t->debug_id, 2976 target_proc->pid, target_node->debug_id, 2977 (u64)tr->data.ptr.buffer, 2978 (u64)tr->data.ptr.offsets, 2979 (u64)tr->data_size, (u64)tr->offsets_size, 2980 (u64)extra_buffers_size); 2981 2982 if (!reply && !(tr->flags & TF_ONE_WAY)) 2983 t->from = thread; 2984 else 2985 t->from = NULL; 2986 t->sender_euid = task_euid(proc->tsk); 2987 t->to_proc = target_proc; 2988 t->to_thread = target_thread; 2989 t->code = tr->code; 2990 t->flags = tr->flags; 2991 t->priority = task_nice(current); 2992 2993 if (target_node && target_node->txn_security_ctx) { 2994 u32 secid; 2995 size_t added_size; 2996 2997 security_cred_getsecid(proc->cred, &secid); 2998 ret = security_secid_to_secctx(secid, &secctx, &secctx_sz); 2999 if (ret) { 3000 return_error = BR_FAILED_REPLY; 3001 return_error_param = ret; 3002 return_error_line = __LINE__; 3003 goto err_get_secctx_failed; 3004 } 3005 added_size = ALIGN(secctx_sz, sizeof(u64)); 3006 extra_buffers_size += added_size; 3007 if (extra_buffers_size < added_size) { 3008 /* integer overflow of extra_buffers_size */ 3009 return_error = BR_FAILED_REPLY; 3010 return_error_param = -EINVAL; 3011 return_error_line = __LINE__; 3012 goto err_bad_extra_size; 3013 } 3014 } 3015 3016 trace_binder_transaction(reply, t, target_node); 3017 3018 t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size, 3019 tr->offsets_size, extra_buffers_size, 3020 !reply && (t->flags & TF_ONE_WAY), current->tgid); 3021 if (IS_ERR(t->buffer)) { 3022 /* 3023 * -ESRCH indicates VMA cleared. The target is dying. 3024 */ 3025 return_error_param = PTR_ERR(t->buffer); 3026 return_error = return_error_param == -ESRCH ? 3027 BR_DEAD_REPLY : BR_FAILED_REPLY; 3028 return_error_line = __LINE__; 3029 t->buffer = NULL; 3030 goto err_binder_alloc_buf_failed; 3031 } 3032 if (secctx) { 3033 int err; 3034 size_t buf_offset = ALIGN(tr->data_size, sizeof(void *)) + 3035 ALIGN(tr->offsets_size, sizeof(void *)) + 3036 ALIGN(extra_buffers_size, sizeof(void *)) - 3037 ALIGN(secctx_sz, sizeof(u64)); 3038 3039 t->security_ctx = (uintptr_t)t->buffer->user_data + buf_offset; 3040 err = binder_alloc_copy_to_buffer(&target_proc->alloc, 3041 t->buffer, buf_offset, 3042 secctx, secctx_sz); 3043 if (err) { 3044 t->security_ctx = 0; 3045 WARN_ON(1); 3046 } 3047 security_release_secctx(secctx, secctx_sz); 3048 secctx = NULL; 3049 } 3050 t->buffer->debug_id = t->debug_id; 3051 t->buffer->transaction = t; 3052 t->buffer->target_node = target_node; 3053 t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF); 3054 trace_binder_transaction_alloc_buf(t->buffer); 3055 3056 if (binder_alloc_copy_user_to_buffer( 3057 &target_proc->alloc, 3058 t->buffer, 3059 ALIGN(tr->data_size, sizeof(void *)), 3060 (const void __user *) 3061 (uintptr_t)tr->data.ptr.offsets, 3062 tr->offsets_size)) { 3063 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 3064 proc->pid, thread->pid); 3065 return_error = BR_FAILED_REPLY; 3066 return_error_param = -EFAULT; 3067 return_error_line = __LINE__; 3068 goto err_copy_data_failed; 3069 } 3070 if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) { 3071 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n", 3072 proc->pid, thread->pid, (u64)tr->offsets_size); 3073 return_error = BR_FAILED_REPLY; 3074 return_error_param = -EINVAL; 3075 return_error_line = __LINE__; 3076 goto err_bad_offset; 3077 } 3078 if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) { 3079 binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n", 3080 proc->pid, thread->pid, 3081 (u64)extra_buffers_size); 3082 return_error = BR_FAILED_REPLY; 3083 return_error_param = -EINVAL; 3084 return_error_line = __LINE__; 3085 goto err_bad_offset; 3086 } 3087 off_start_offset = ALIGN(tr->data_size, sizeof(void *)); 3088 buffer_offset = off_start_offset; 3089 off_end_offset = off_start_offset + tr->offsets_size; 3090 sg_buf_offset = ALIGN(off_end_offset, sizeof(void *)); 3091 sg_buf_end_offset = sg_buf_offset + extra_buffers_size - 3092 ALIGN(secctx_sz, sizeof(u64)); 3093 off_min = 0; 3094 for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; 3095 buffer_offset += sizeof(binder_size_t)) { 3096 struct binder_object_header *hdr; 3097 size_t object_size; 3098 struct binder_object object; 3099 binder_size_t object_offset; 3100 binder_size_t copy_size; 3101 3102 if (binder_alloc_copy_from_buffer(&target_proc->alloc, 3103 &object_offset, 3104 t->buffer, 3105 buffer_offset, 3106 sizeof(object_offset))) { 3107 return_error = BR_FAILED_REPLY; 3108 return_error_param = -EINVAL; 3109 return_error_line = __LINE__; 3110 goto err_bad_offset; 3111 } 3112 3113 /* 3114 * Copy the source user buffer up to the next object 3115 * that will be processed. 3116 */ 3117 copy_size = object_offset - user_offset; 3118 if (copy_size && (user_offset > object_offset || 3119 binder_alloc_copy_user_to_buffer( 3120 &target_proc->alloc, 3121 t->buffer, user_offset, 3122 user_buffer + user_offset, 3123 copy_size))) { 3124 binder_user_error("%d:%d got transaction with invalid data ptr\n", 3125 proc->pid, thread->pid); 3126 return_error = BR_FAILED_REPLY; 3127 return_error_param = -EFAULT; 3128 return_error_line = __LINE__; 3129 goto err_copy_data_failed; 3130 } 3131 object_size = binder_get_object(target_proc, user_buffer, 3132 t->buffer, object_offset, &object); 3133 if (object_size == 0 || object_offset < off_min) { 3134 binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n", 3135 proc->pid, thread->pid, 3136 (u64)object_offset, 3137 (u64)off_min, 3138 (u64)t->buffer->data_size); 3139 return_error = BR_FAILED_REPLY; 3140 return_error_param = -EINVAL; 3141 return_error_line = __LINE__; 3142 goto err_bad_offset; 3143 } 3144 /* 3145 * Set offset to the next buffer fragment to be 3146 * copied 3147 */ 3148 user_offset = object_offset + object_size; 3149 3150 hdr = &object.hdr; 3151 off_min = object_offset + object_size; 3152 switch (hdr->type) { 3153 case BINDER_TYPE_BINDER: 3154 case BINDER_TYPE_WEAK_BINDER: { 3155 struct flat_binder_object *fp; 3156 3157 fp = to_flat_binder_object(hdr); 3158 ret = binder_translate_binder(fp, t, thread); 3159 3160 if (ret < 0 || 3161 binder_alloc_copy_to_buffer(&target_proc->alloc, 3162 t->buffer, 3163 object_offset, 3164 fp, sizeof(*fp))) { 3165 return_error = BR_FAILED_REPLY; 3166 return_error_param = ret; 3167 return_error_line = __LINE__; 3168 goto err_translate_failed; 3169 } 3170 } break; 3171 case BINDER_TYPE_HANDLE: 3172 case BINDER_TYPE_WEAK_HANDLE: { 3173 struct flat_binder_object *fp; 3174 3175 fp = to_flat_binder_object(hdr); 3176 ret = binder_translate_handle(fp, t, thread); 3177 if (ret < 0 || 3178 binder_alloc_copy_to_buffer(&target_proc->alloc, 3179 t->buffer, 3180 object_offset, 3181 fp, sizeof(*fp))) { 3182 return_error = BR_FAILED_REPLY; 3183 return_error_param = ret; 3184 return_error_line = __LINE__; 3185 goto err_translate_failed; 3186 } 3187 } break; 3188 3189 case BINDER_TYPE_FD: { 3190 struct binder_fd_object *fp = to_binder_fd_object(hdr); 3191 binder_size_t fd_offset = object_offset + 3192 (uintptr_t)&fp->fd - (uintptr_t)fp; 3193 int ret = binder_translate_fd(fp->fd, fd_offset, t, 3194 thread, in_reply_to); 3195 3196 fp->pad_binder = 0; 3197 if (ret < 0 || 3198 binder_alloc_copy_to_buffer(&target_proc->alloc, 3199 t->buffer, 3200 object_offset, 3201 fp, sizeof(*fp))) { 3202 return_error = BR_FAILED_REPLY; 3203 return_error_param = ret; 3204 return_error_line = __LINE__; 3205 goto err_translate_failed; 3206 } 3207 } break; 3208 case BINDER_TYPE_FDA: { 3209 struct binder_object ptr_object; 3210 binder_size_t parent_offset; 3211 struct binder_object user_object; 3212 size_t user_parent_size; 3213 struct binder_fd_array_object *fda = 3214 to_binder_fd_array_object(hdr); 3215 size_t num_valid = (buffer_offset - off_start_offset) / 3216 sizeof(binder_size_t); 3217 struct binder_buffer_object *parent = 3218 binder_validate_ptr(target_proc, t->buffer, 3219 &ptr_object, fda->parent, 3220 off_start_offset, 3221 &parent_offset, 3222 num_valid); 3223 if (!parent) { 3224 binder_user_error("%d:%d got transaction with invalid parent offset or type\n", 3225 proc->pid, thread->pid); 3226 return_error = BR_FAILED_REPLY; 3227 return_error_param = -EINVAL; 3228 return_error_line = __LINE__; 3229 goto err_bad_parent; 3230 } 3231 if (!binder_validate_fixup(target_proc, t->buffer, 3232 off_start_offset, 3233 parent_offset, 3234 fda->parent_offset, 3235 last_fixup_obj_off, 3236 last_fixup_min_off)) { 3237 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n", 3238 proc->pid, thread->pid); 3239 return_error = BR_FAILED_REPLY; 3240 return_error_param = -EINVAL; 3241 return_error_line = __LINE__; 3242 goto err_bad_parent; 3243 } 3244 /* 3245 * We need to read the user version of the parent 3246 * object to get the original user offset 3247 */ 3248 user_parent_size = 3249 binder_get_object(proc, user_buffer, t->buffer, 3250 parent_offset, &user_object); 3251 if (user_parent_size != sizeof(user_object.bbo)) { 3252 binder_user_error("%d:%d invalid ptr object size: %zd vs %zd\n", 3253 proc->pid, thread->pid, 3254 user_parent_size, 3255 sizeof(user_object.bbo)); 3256 return_error = BR_FAILED_REPLY; 3257 return_error_param = -EINVAL; 3258 return_error_line = __LINE__; 3259 goto err_bad_parent; 3260 } 3261 ret = binder_translate_fd_array(&pf_head, fda, 3262 user_buffer, parent, 3263 &user_object.bbo, t, 3264 thread, in_reply_to); 3265 if (!ret) 3266 ret = binder_alloc_copy_to_buffer(&target_proc->alloc, 3267 t->buffer, 3268 object_offset, 3269 fda, sizeof(*fda)); 3270 if (ret) { 3271 return_error = BR_FAILED_REPLY; 3272 return_error_param = ret > 0 ? -EINVAL : ret; 3273 return_error_line = __LINE__; 3274 goto err_translate_failed; 3275 } 3276 last_fixup_obj_off = parent_offset; 3277 last_fixup_min_off = 3278 fda->parent_offset + sizeof(u32) * fda->num_fds; 3279 } break; 3280 case BINDER_TYPE_PTR: { 3281 struct binder_buffer_object *bp = 3282 to_binder_buffer_object(hdr); 3283 size_t buf_left = sg_buf_end_offset - sg_buf_offset; 3284 size_t num_valid; 3285 3286 if (bp->length > buf_left) { 3287 binder_user_error("%d:%d got transaction with too large buffer\n", 3288 proc->pid, thread->pid); 3289 return_error = BR_FAILED_REPLY; 3290 return_error_param = -EINVAL; 3291 return_error_line = __LINE__; 3292 goto err_bad_offset; 3293 } 3294 ret = binder_defer_copy(&sgc_head, sg_buf_offset, 3295 (const void __user *)(uintptr_t)bp->buffer, 3296 bp->length); 3297 if (ret) { 3298 return_error = BR_FAILED_REPLY; 3299 return_error_param = ret; 3300 return_error_line = __LINE__; 3301 goto err_translate_failed; 3302 } 3303 /* Fixup buffer pointer to target proc address space */ 3304 bp->buffer = (uintptr_t) 3305 t->buffer->user_data + sg_buf_offset; 3306 sg_buf_offset += ALIGN(bp->length, sizeof(u64)); 3307 3308 num_valid = (buffer_offset - off_start_offset) / 3309 sizeof(binder_size_t); 3310 ret = binder_fixup_parent(&pf_head, t, 3311 thread, bp, 3312 off_start_offset, 3313 num_valid, 3314 last_fixup_obj_off, 3315 last_fixup_min_off); 3316 if (ret < 0 || 3317 binder_alloc_copy_to_buffer(&target_proc->alloc, 3318 t->buffer, 3319 object_offset, 3320 bp, sizeof(*bp))) { 3321 return_error = BR_FAILED_REPLY; 3322 return_error_param = ret; 3323 return_error_line = __LINE__; 3324 goto err_translate_failed; 3325 } 3326 last_fixup_obj_off = object_offset; 3327 last_fixup_min_off = 0; 3328 } break; 3329 default: 3330 binder_user_error("%d:%d got transaction with invalid object type, %x\n", 3331 proc->pid, thread->pid, hdr->type); 3332 return_error = BR_FAILED_REPLY; 3333 return_error_param = -EINVAL; 3334 return_error_line = __LINE__; 3335 goto err_bad_object_type; 3336 } 3337 } 3338 /* Done processing objects, copy the rest of the buffer */ 3339 if (binder_alloc_copy_user_to_buffer( 3340 &target_proc->alloc, 3341 t->buffer, user_offset, 3342 user_buffer + user_offset, 3343 tr->data_size - user_offset)) { 3344 binder_user_error("%d:%d got transaction with invalid data ptr\n", 3345 proc->pid, thread->pid); 3346 return_error = BR_FAILED_REPLY; 3347 return_error_param = -EFAULT; 3348 return_error_line = __LINE__; 3349 goto err_copy_data_failed; 3350 } 3351 3352 ret = binder_do_deferred_txn_copies(&target_proc->alloc, t->buffer, 3353 &sgc_head, &pf_head); 3354 if (ret) { 3355 binder_user_error("%d:%d got transaction with invalid offsets ptr\n", 3356 proc->pid, thread->pid); 3357 return_error = BR_FAILED_REPLY; 3358 return_error_param = ret; 3359 return_error_line = __LINE__; 3360 goto err_copy_data_failed; 3361 } 3362 if (t->buffer->oneway_spam_suspect) 3363 tcomplete->type = BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT; 3364 else 3365 tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; 3366 t->work.type = BINDER_WORK_TRANSACTION; 3367 3368 if (reply) { 3369 binder_enqueue_thread_work(thread, tcomplete); 3370 binder_inner_proc_lock(target_proc); 3371 if (target_thread->is_dead) { 3372 return_error = BR_DEAD_REPLY; 3373 binder_inner_proc_unlock(target_proc); 3374 goto err_dead_proc_or_thread; 3375 } 3376 BUG_ON(t->buffer->async_transaction != 0); 3377 binder_pop_transaction_ilocked(target_thread, in_reply_to); 3378 binder_enqueue_thread_work_ilocked(target_thread, &t->work); 3379 target_proc->outstanding_txns++; 3380 binder_inner_proc_unlock(target_proc); 3381 wake_up_interruptible_sync(&target_thread->wait); 3382 binder_free_transaction(in_reply_to); 3383 } else if (!(t->flags & TF_ONE_WAY)) { 3384 BUG_ON(t->buffer->async_transaction != 0); 3385 binder_inner_proc_lock(proc); 3386 /* 3387 * Defer the TRANSACTION_COMPLETE, so we don't return to 3388 * userspace immediately; this allows the target process to 3389 * immediately start processing this transaction, reducing 3390 * latency. We will then return the TRANSACTION_COMPLETE when 3391 * the target replies (or there is an error). 3392 */ 3393 binder_enqueue_deferred_thread_work_ilocked(thread, tcomplete); 3394 t->need_reply = 1; 3395 t->from_parent = thread->transaction_stack; 3396 thread->transaction_stack = t; 3397 binder_inner_proc_unlock(proc); 3398 return_error = binder_proc_transaction(t, 3399 target_proc, target_thread); 3400 if (return_error) { 3401 binder_inner_proc_lock(proc); 3402 binder_pop_transaction_ilocked(thread, t); 3403 binder_inner_proc_unlock(proc); 3404 goto err_dead_proc_or_thread; 3405 } 3406 } else { 3407 BUG_ON(target_node == NULL); 3408 BUG_ON(t->buffer->async_transaction != 1); 3409 binder_enqueue_thread_work(thread, tcomplete); 3410 return_error = binder_proc_transaction(t, target_proc, NULL); 3411 if (return_error) 3412 goto err_dead_proc_or_thread; 3413 } 3414 if (target_thread) 3415 binder_thread_dec_tmpref(target_thread); 3416 binder_proc_dec_tmpref(target_proc); 3417 if (target_node) 3418 binder_dec_node_tmpref(target_node); 3419 /* 3420 * write barrier to synchronize with initialization 3421 * of log entry 3422 */ 3423 smp_wmb(); 3424 WRITE_ONCE(e->debug_id_done, t_debug_id); 3425 return; 3426 3427 err_dead_proc_or_thread: 3428 return_error_line = __LINE__; 3429 binder_dequeue_work(proc, tcomplete); 3430 err_translate_failed: 3431 err_bad_object_type: 3432 err_bad_offset: 3433 err_bad_parent: 3434 err_copy_data_failed: 3435 binder_cleanup_deferred_txn_lists(&sgc_head, &pf_head); 3436 binder_free_txn_fixups(t); 3437 trace_binder_transaction_failed_buffer_release(t->buffer); 3438 binder_transaction_buffer_release(target_proc, NULL, t->buffer, 3439 buffer_offset, true); 3440 if (target_node) 3441 binder_dec_node_tmpref(target_node); 3442 target_node = NULL; 3443 t->buffer->transaction = NULL; 3444 binder_alloc_free_buf(&target_proc->alloc, t->buffer); 3445 err_binder_alloc_buf_failed: 3446 err_bad_extra_size: 3447 if (secctx) 3448 security_release_secctx(secctx, secctx_sz); 3449 err_get_secctx_failed: 3450 kfree(tcomplete); 3451 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 3452 err_alloc_tcomplete_failed: 3453 if (trace_binder_txn_latency_free_enabled()) 3454 binder_txn_latency_free(t); 3455 kfree(t); 3456 binder_stats_deleted(BINDER_STAT_TRANSACTION); 3457 err_alloc_t_failed: 3458 err_bad_todo_list: 3459 err_bad_call_stack: 3460 err_empty_call_stack: 3461 err_dead_binder: 3462 err_invalid_target_handle: 3463 if (target_thread) 3464 binder_thread_dec_tmpref(target_thread); 3465 if (target_proc) 3466 binder_proc_dec_tmpref(target_proc); 3467 if (target_node) { 3468 binder_dec_node(target_node, 1, 0); 3469 binder_dec_node_tmpref(target_node); 3470 } 3471 3472 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 3473 "%d:%d transaction failed %d/%d, size %lld-%lld line %d\n", 3474 proc->pid, thread->pid, return_error, return_error_param, 3475 (u64)tr->data_size, (u64)tr->offsets_size, 3476 return_error_line); 3477 3478 { 3479 struct binder_transaction_log_entry *fe; 3480 3481 e->return_error = return_error; 3482 e->return_error_param = return_error_param; 3483 e->return_error_line = return_error_line; 3484 fe = binder_transaction_log_add(&binder_transaction_log_failed); 3485 *fe = *e; 3486 /* 3487 * write barrier to synchronize with initialization 3488 * of log entry 3489 */ 3490 smp_wmb(); 3491 WRITE_ONCE(e->debug_id_done, t_debug_id); 3492 WRITE_ONCE(fe->debug_id_done, t_debug_id); 3493 } 3494 3495 BUG_ON(thread->return_error.cmd != BR_OK); 3496 if (in_reply_to) { 3497 thread->return_error.cmd = BR_TRANSACTION_COMPLETE; 3498 binder_enqueue_thread_work(thread, &thread->return_error.work); 3499 binder_send_failed_reply(in_reply_to, return_error); 3500 } else { 3501 thread->return_error.cmd = return_error; 3502 binder_enqueue_thread_work(thread, &thread->return_error.work); 3503 } 3504 } 3505 3506 /** 3507 * binder_free_buf() - free the specified buffer 3508 * @proc: binder proc that owns buffer 3509 * @buffer: buffer to be freed 3510 * @is_failure: failed to send transaction 3511 * 3512 * If buffer for an async transaction, enqueue the next async 3513 * transaction from the node. 3514 * 3515 * Cleanup buffer and free it. 3516 */ 3517 static void 3518 binder_free_buf(struct binder_proc *proc, 3519 struct binder_thread *thread, 3520 struct binder_buffer *buffer, bool is_failure) 3521 { 3522 binder_inner_proc_lock(proc); 3523 if (buffer->transaction) { 3524 buffer->transaction->buffer = NULL; 3525 buffer->transaction = NULL; 3526 } 3527 binder_inner_proc_unlock(proc); 3528 if (buffer->async_transaction && buffer->target_node) { 3529 struct binder_node *buf_node; 3530 struct binder_work *w; 3531 3532 buf_node = buffer->target_node; 3533 binder_node_inner_lock(buf_node); 3534 BUG_ON(!buf_node->has_async_transaction); 3535 BUG_ON(buf_node->proc != proc); 3536 w = binder_dequeue_work_head_ilocked( 3537 &buf_node->async_todo); 3538 if (!w) { 3539 buf_node->has_async_transaction = false; 3540 } else { 3541 binder_enqueue_work_ilocked( 3542 w, &proc->todo); 3543 binder_wakeup_proc_ilocked(proc); 3544 } 3545 binder_node_inner_unlock(buf_node); 3546 } 3547 trace_binder_transaction_buffer_release(buffer); 3548 binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); 3549 binder_alloc_free_buf(&proc->alloc, buffer); 3550 } 3551 3552 static int binder_thread_write(struct binder_proc *proc, 3553 struct binder_thread *thread, 3554 binder_uintptr_t binder_buffer, size_t size, 3555 binder_size_t *consumed) 3556 { 3557 uint32_t cmd; 3558 struct binder_context *context = proc->context; 3559 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 3560 void __user *ptr = buffer + *consumed; 3561 void __user *end = buffer + size; 3562 3563 while (ptr < end && thread->return_error.cmd == BR_OK) { 3564 int ret; 3565 3566 if (get_user(cmd, (uint32_t __user *)ptr)) 3567 return -EFAULT; 3568 ptr += sizeof(uint32_t); 3569 trace_binder_command(cmd); 3570 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.bc)) { 3571 atomic_inc(&binder_stats.bc[_IOC_NR(cmd)]); 3572 atomic_inc(&proc->stats.bc[_IOC_NR(cmd)]); 3573 atomic_inc(&thread->stats.bc[_IOC_NR(cmd)]); 3574 } 3575 switch (cmd) { 3576 case BC_INCREFS: 3577 case BC_ACQUIRE: 3578 case BC_RELEASE: 3579 case BC_DECREFS: { 3580 uint32_t target; 3581 const char *debug_string; 3582 bool strong = cmd == BC_ACQUIRE || cmd == BC_RELEASE; 3583 bool increment = cmd == BC_INCREFS || cmd == BC_ACQUIRE; 3584 struct binder_ref_data rdata; 3585 3586 if (get_user(target, (uint32_t __user *)ptr)) 3587 return -EFAULT; 3588 3589 ptr += sizeof(uint32_t); 3590 ret = -1; 3591 if (increment && !target) { 3592 struct binder_node *ctx_mgr_node; 3593 3594 mutex_lock(&context->context_mgr_node_lock); 3595 ctx_mgr_node = context->binder_context_mgr_node; 3596 if (ctx_mgr_node) { 3597 if (ctx_mgr_node->proc == proc) { 3598 binder_user_error("%d:%d context manager tried to acquire desc 0\n", 3599 proc->pid, thread->pid); 3600 mutex_unlock(&context->context_mgr_node_lock); 3601 return -EINVAL; 3602 } 3603 ret = binder_inc_ref_for_node( 3604 proc, ctx_mgr_node, 3605 strong, NULL, &rdata); 3606 } 3607 mutex_unlock(&context->context_mgr_node_lock); 3608 } 3609 if (ret) 3610 ret = binder_update_ref_for_handle( 3611 proc, target, increment, strong, 3612 &rdata); 3613 if (!ret && rdata.desc != target) { 3614 binder_user_error("%d:%d tried to acquire reference to desc %d, got %d instead\n", 3615 proc->pid, thread->pid, 3616 target, rdata.desc); 3617 } 3618 switch (cmd) { 3619 case BC_INCREFS: 3620 debug_string = "IncRefs"; 3621 break; 3622 case BC_ACQUIRE: 3623 debug_string = "Acquire"; 3624 break; 3625 case BC_RELEASE: 3626 debug_string = "Release"; 3627 break; 3628 case BC_DECREFS: 3629 default: 3630 debug_string = "DecRefs"; 3631 break; 3632 } 3633 if (ret) { 3634 binder_user_error("%d:%d %s %d refcount change on invalid ref %d ret %d\n", 3635 proc->pid, thread->pid, debug_string, 3636 strong, target, ret); 3637 break; 3638 } 3639 binder_debug(BINDER_DEBUG_USER_REFS, 3640 "%d:%d %s ref %d desc %d s %d w %d\n", 3641 proc->pid, thread->pid, debug_string, 3642 rdata.debug_id, rdata.desc, rdata.strong, 3643 rdata.weak); 3644 break; 3645 } 3646 case BC_INCREFS_DONE: 3647 case BC_ACQUIRE_DONE: { 3648 binder_uintptr_t node_ptr; 3649 binder_uintptr_t cookie; 3650 struct binder_node *node; 3651 bool free_node; 3652 3653 if (get_user(node_ptr, (binder_uintptr_t __user *)ptr)) 3654 return -EFAULT; 3655 ptr += sizeof(binder_uintptr_t); 3656 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 3657 return -EFAULT; 3658 ptr += sizeof(binder_uintptr_t); 3659 node = binder_get_node(proc, node_ptr); 3660 if (node == NULL) { 3661 binder_user_error("%d:%d %s u%016llx no match\n", 3662 proc->pid, thread->pid, 3663 cmd == BC_INCREFS_DONE ? 3664 "BC_INCREFS_DONE" : 3665 "BC_ACQUIRE_DONE", 3666 (u64)node_ptr); 3667 break; 3668 } 3669 if (cookie != node->cookie) { 3670 binder_user_error("%d:%d %s u%016llx node %d cookie mismatch %016llx != %016llx\n", 3671 proc->pid, thread->pid, 3672 cmd == BC_INCREFS_DONE ? 3673 "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 3674 (u64)node_ptr, node->debug_id, 3675 (u64)cookie, (u64)node->cookie); 3676 binder_put_node(node); 3677 break; 3678 } 3679 binder_node_inner_lock(node); 3680 if (cmd == BC_ACQUIRE_DONE) { 3681 if (node->pending_strong_ref == 0) { 3682 binder_user_error("%d:%d BC_ACQUIRE_DONE node %d has no pending acquire request\n", 3683 proc->pid, thread->pid, 3684 node->debug_id); 3685 binder_node_inner_unlock(node); 3686 binder_put_node(node); 3687 break; 3688 } 3689 node->pending_strong_ref = 0; 3690 } else { 3691 if (node->pending_weak_ref == 0) { 3692 binder_user_error("%d:%d BC_INCREFS_DONE node %d has no pending increfs request\n", 3693 proc->pid, thread->pid, 3694 node->debug_id); 3695 binder_node_inner_unlock(node); 3696 binder_put_node(node); 3697 break; 3698 } 3699 node->pending_weak_ref = 0; 3700 } 3701 free_node = binder_dec_node_nilocked(node, 3702 cmd == BC_ACQUIRE_DONE, 0); 3703 WARN_ON(free_node); 3704 binder_debug(BINDER_DEBUG_USER_REFS, 3705 "%d:%d %s node %d ls %d lw %d tr %d\n", 3706 proc->pid, thread->pid, 3707 cmd == BC_INCREFS_DONE ? "BC_INCREFS_DONE" : "BC_ACQUIRE_DONE", 3708 node->debug_id, node->local_strong_refs, 3709 node->local_weak_refs, node->tmp_refs); 3710 binder_node_inner_unlock(node); 3711 binder_put_node(node); 3712 break; 3713 } 3714 case BC_ATTEMPT_ACQUIRE: 3715 pr_err("BC_ATTEMPT_ACQUIRE not supported\n"); 3716 return -EINVAL; 3717 case BC_ACQUIRE_RESULT: 3718 pr_err("BC_ACQUIRE_RESULT not supported\n"); 3719 return -EINVAL; 3720 3721 case BC_FREE_BUFFER: { 3722 binder_uintptr_t data_ptr; 3723 struct binder_buffer *buffer; 3724 3725 if (get_user(data_ptr, (binder_uintptr_t __user *)ptr)) 3726 return -EFAULT; 3727 ptr += sizeof(binder_uintptr_t); 3728 3729 buffer = binder_alloc_prepare_to_free(&proc->alloc, 3730 data_ptr); 3731 if (IS_ERR_OR_NULL(buffer)) { 3732 if (PTR_ERR(buffer) == -EPERM) { 3733 binder_user_error( 3734 "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n", 3735 proc->pid, thread->pid, 3736 (u64)data_ptr); 3737 } else { 3738 binder_user_error( 3739 "%d:%d BC_FREE_BUFFER u%016llx no match\n", 3740 proc->pid, thread->pid, 3741 (u64)data_ptr); 3742 } 3743 break; 3744 } 3745 binder_debug(BINDER_DEBUG_FREE_BUFFER, 3746 "%d:%d BC_FREE_BUFFER u%016llx found buffer %d for %s transaction\n", 3747 proc->pid, thread->pid, (u64)data_ptr, 3748 buffer->debug_id, 3749 buffer->transaction ? "active" : "finished"); 3750 binder_free_buf(proc, thread, buffer, false); 3751 break; 3752 } 3753 3754 case BC_TRANSACTION_SG: 3755 case BC_REPLY_SG: { 3756 struct binder_transaction_data_sg tr; 3757 3758 if (copy_from_user(&tr, ptr, sizeof(tr))) 3759 return -EFAULT; 3760 ptr += sizeof(tr); 3761 binder_transaction(proc, thread, &tr.transaction_data, 3762 cmd == BC_REPLY_SG, tr.buffers_size); 3763 break; 3764 } 3765 case BC_TRANSACTION: 3766 case BC_REPLY: { 3767 struct binder_transaction_data tr; 3768 3769 if (copy_from_user(&tr, ptr, sizeof(tr))) 3770 return -EFAULT; 3771 ptr += sizeof(tr); 3772 binder_transaction(proc, thread, &tr, 3773 cmd == BC_REPLY, 0); 3774 break; 3775 } 3776 3777 case BC_REGISTER_LOOPER: 3778 binder_debug(BINDER_DEBUG_THREADS, 3779 "%d:%d BC_REGISTER_LOOPER\n", 3780 proc->pid, thread->pid); 3781 binder_inner_proc_lock(proc); 3782 if (thread->looper & BINDER_LOOPER_STATE_ENTERED) { 3783 thread->looper |= BINDER_LOOPER_STATE_INVALID; 3784 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER\n", 3785 proc->pid, thread->pid); 3786 } else if (proc->requested_threads == 0) { 3787 thread->looper |= BINDER_LOOPER_STATE_INVALID; 3788 binder_user_error("%d:%d ERROR: BC_REGISTER_LOOPER called without request\n", 3789 proc->pid, thread->pid); 3790 } else { 3791 proc->requested_threads--; 3792 proc->requested_threads_started++; 3793 } 3794 thread->looper |= BINDER_LOOPER_STATE_REGISTERED; 3795 binder_inner_proc_unlock(proc); 3796 break; 3797 case BC_ENTER_LOOPER: 3798 binder_debug(BINDER_DEBUG_THREADS, 3799 "%d:%d BC_ENTER_LOOPER\n", 3800 proc->pid, thread->pid); 3801 if (thread->looper & BINDER_LOOPER_STATE_REGISTERED) { 3802 thread->looper |= BINDER_LOOPER_STATE_INVALID; 3803 binder_user_error("%d:%d ERROR: BC_ENTER_LOOPER called after BC_REGISTER_LOOPER\n", 3804 proc->pid, thread->pid); 3805 } 3806 thread->looper |= BINDER_LOOPER_STATE_ENTERED; 3807 break; 3808 case BC_EXIT_LOOPER: 3809 binder_debug(BINDER_DEBUG_THREADS, 3810 "%d:%d BC_EXIT_LOOPER\n", 3811 proc->pid, thread->pid); 3812 thread->looper |= BINDER_LOOPER_STATE_EXITED; 3813 break; 3814 3815 case BC_REQUEST_DEATH_NOTIFICATION: 3816 case BC_CLEAR_DEATH_NOTIFICATION: { 3817 uint32_t target; 3818 binder_uintptr_t cookie; 3819 struct binder_ref *ref; 3820 struct binder_ref_death *death = NULL; 3821 3822 if (get_user(target, (uint32_t __user *)ptr)) 3823 return -EFAULT; 3824 ptr += sizeof(uint32_t); 3825 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 3826 return -EFAULT; 3827 ptr += sizeof(binder_uintptr_t); 3828 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 3829 /* 3830 * Allocate memory for death notification 3831 * before taking lock 3832 */ 3833 death = kzalloc(sizeof(*death), GFP_KERNEL); 3834 if (death == NULL) { 3835 WARN_ON(thread->return_error.cmd != 3836 BR_OK); 3837 thread->return_error.cmd = BR_ERROR; 3838 binder_enqueue_thread_work( 3839 thread, 3840 &thread->return_error.work); 3841 binder_debug( 3842 BINDER_DEBUG_FAILED_TRANSACTION, 3843 "%d:%d BC_REQUEST_DEATH_NOTIFICATION failed\n", 3844 proc->pid, thread->pid); 3845 break; 3846 } 3847 } 3848 binder_proc_lock(proc); 3849 ref = binder_get_ref_olocked(proc, target, false); 3850 if (ref == NULL) { 3851 binder_user_error("%d:%d %s invalid ref %d\n", 3852 proc->pid, thread->pid, 3853 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 3854 "BC_REQUEST_DEATH_NOTIFICATION" : 3855 "BC_CLEAR_DEATH_NOTIFICATION", 3856 target); 3857 binder_proc_unlock(proc); 3858 kfree(death); 3859 break; 3860 } 3861 3862 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 3863 "%d:%d %s %016llx ref %d desc %d s %d w %d for node %d\n", 3864 proc->pid, thread->pid, 3865 cmd == BC_REQUEST_DEATH_NOTIFICATION ? 3866 "BC_REQUEST_DEATH_NOTIFICATION" : 3867 "BC_CLEAR_DEATH_NOTIFICATION", 3868 (u64)cookie, ref->data.debug_id, 3869 ref->data.desc, ref->data.strong, 3870 ref->data.weak, ref->node->debug_id); 3871 3872 binder_node_lock(ref->node); 3873 if (cmd == BC_REQUEST_DEATH_NOTIFICATION) { 3874 if (ref->death) { 3875 binder_user_error("%d:%d BC_REQUEST_DEATH_NOTIFICATION death notification already set\n", 3876 proc->pid, thread->pid); 3877 binder_node_unlock(ref->node); 3878 binder_proc_unlock(proc); 3879 kfree(death); 3880 break; 3881 } 3882 binder_stats_created(BINDER_STAT_DEATH); 3883 INIT_LIST_HEAD(&death->work.entry); 3884 death->cookie = cookie; 3885 ref->death = death; 3886 if (ref->node->proc == NULL) { 3887 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 3888 3889 binder_inner_proc_lock(proc); 3890 binder_enqueue_work_ilocked( 3891 &ref->death->work, &proc->todo); 3892 binder_wakeup_proc_ilocked(proc); 3893 binder_inner_proc_unlock(proc); 3894 } 3895 } else { 3896 if (ref->death == NULL) { 3897 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification not active\n", 3898 proc->pid, thread->pid); 3899 binder_node_unlock(ref->node); 3900 binder_proc_unlock(proc); 3901 break; 3902 } 3903 death = ref->death; 3904 if (death->cookie != cookie) { 3905 binder_user_error("%d:%d BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch %016llx != %016llx\n", 3906 proc->pid, thread->pid, 3907 (u64)death->cookie, 3908 (u64)cookie); 3909 binder_node_unlock(ref->node); 3910 binder_proc_unlock(proc); 3911 break; 3912 } 3913 ref->death = NULL; 3914 binder_inner_proc_lock(proc); 3915 if (list_empty(&death->work.entry)) { 3916 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 3917 if (thread->looper & 3918 (BINDER_LOOPER_STATE_REGISTERED | 3919 BINDER_LOOPER_STATE_ENTERED)) 3920 binder_enqueue_thread_work_ilocked( 3921 thread, 3922 &death->work); 3923 else { 3924 binder_enqueue_work_ilocked( 3925 &death->work, 3926 &proc->todo); 3927 binder_wakeup_proc_ilocked( 3928 proc); 3929 } 3930 } else { 3931 BUG_ON(death->work.type != BINDER_WORK_DEAD_BINDER); 3932 death->work.type = BINDER_WORK_DEAD_BINDER_AND_CLEAR; 3933 } 3934 binder_inner_proc_unlock(proc); 3935 } 3936 binder_node_unlock(ref->node); 3937 binder_proc_unlock(proc); 3938 } break; 3939 case BC_DEAD_BINDER_DONE: { 3940 struct binder_work *w; 3941 binder_uintptr_t cookie; 3942 struct binder_ref_death *death = NULL; 3943 3944 if (get_user(cookie, (binder_uintptr_t __user *)ptr)) 3945 return -EFAULT; 3946 3947 ptr += sizeof(cookie); 3948 binder_inner_proc_lock(proc); 3949 list_for_each_entry(w, &proc->delivered_death, 3950 entry) { 3951 struct binder_ref_death *tmp_death = 3952 container_of(w, 3953 struct binder_ref_death, 3954 work); 3955 3956 if (tmp_death->cookie == cookie) { 3957 death = tmp_death; 3958 break; 3959 } 3960 } 3961 binder_debug(BINDER_DEBUG_DEAD_BINDER, 3962 "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n", 3963 proc->pid, thread->pid, (u64)cookie, 3964 death); 3965 if (death == NULL) { 3966 binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n", 3967 proc->pid, thread->pid, (u64)cookie); 3968 binder_inner_proc_unlock(proc); 3969 break; 3970 } 3971 binder_dequeue_work_ilocked(&death->work); 3972 if (death->work.type == BINDER_WORK_DEAD_BINDER_AND_CLEAR) { 3973 death->work.type = BINDER_WORK_CLEAR_DEATH_NOTIFICATION; 3974 if (thread->looper & 3975 (BINDER_LOOPER_STATE_REGISTERED | 3976 BINDER_LOOPER_STATE_ENTERED)) 3977 binder_enqueue_thread_work_ilocked( 3978 thread, &death->work); 3979 else { 3980 binder_enqueue_work_ilocked( 3981 &death->work, 3982 &proc->todo); 3983 binder_wakeup_proc_ilocked(proc); 3984 } 3985 } 3986 binder_inner_proc_unlock(proc); 3987 } break; 3988 3989 default: 3990 pr_err("%d:%d unknown command %d\n", 3991 proc->pid, thread->pid, cmd); 3992 return -EINVAL; 3993 } 3994 *consumed = ptr - buffer; 3995 } 3996 return 0; 3997 } 3998 3999 static void binder_stat_br(struct binder_proc *proc, 4000 struct binder_thread *thread, uint32_t cmd) 4001 { 4002 trace_binder_return(cmd); 4003 if (_IOC_NR(cmd) < ARRAY_SIZE(binder_stats.br)) { 4004 atomic_inc(&binder_stats.br[_IOC_NR(cmd)]); 4005 atomic_inc(&proc->stats.br[_IOC_NR(cmd)]); 4006 atomic_inc(&thread->stats.br[_IOC_NR(cmd)]); 4007 } 4008 } 4009 4010 static int binder_put_node_cmd(struct binder_proc *proc, 4011 struct binder_thread *thread, 4012 void __user **ptrp, 4013 binder_uintptr_t node_ptr, 4014 binder_uintptr_t node_cookie, 4015 int node_debug_id, 4016 uint32_t cmd, const char *cmd_name) 4017 { 4018 void __user *ptr = *ptrp; 4019 4020 if (put_user(cmd, (uint32_t __user *)ptr)) 4021 return -EFAULT; 4022 ptr += sizeof(uint32_t); 4023 4024 if (put_user(node_ptr, (binder_uintptr_t __user *)ptr)) 4025 return -EFAULT; 4026 ptr += sizeof(binder_uintptr_t); 4027 4028 if (put_user(node_cookie, (binder_uintptr_t __user *)ptr)) 4029 return -EFAULT; 4030 ptr += sizeof(binder_uintptr_t); 4031 4032 binder_stat_br(proc, thread, cmd); 4033 binder_debug(BINDER_DEBUG_USER_REFS, "%d:%d %s %d u%016llx c%016llx\n", 4034 proc->pid, thread->pid, cmd_name, node_debug_id, 4035 (u64)node_ptr, (u64)node_cookie); 4036 4037 *ptrp = ptr; 4038 return 0; 4039 } 4040 4041 static int binder_wait_for_work(struct binder_thread *thread, 4042 bool do_proc_work) 4043 { 4044 DEFINE_WAIT(wait); 4045 struct binder_proc *proc = thread->proc; 4046 int ret = 0; 4047 4048 freezer_do_not_count(); 4049 binder_inner_proc_lock(proc); 4050 for (;;) { 4051 prepare_to_wait(&thread->wait, &wait, TASK_INTERRUPTIBLE); 4052 if (binder_has_work_ilocked(thread, do_proc_work)) 4053 break; 4054 if (do_proc_work) 4055 list_add(&thread->waiting_thread_node, 4056 &proc->waiting_threads); 4057 binder_inner_proc_unlock(proc); 4058 schedule(); 4059 binder_inner_proc_lock(proc); 4060 list_del_init(&thread->waiting_thread_node); 4061 if (signal_pending(current)) { 4062 ret = -EINTR; 4063 break; 4064 } 4065 } 4066 finish_wait(&thread->wait, &wait); 4067 binder_inner_proc_unlock(proc); 4068 freezer_count(); 4069 4070 return ret; 4071 } 4072 4073 /** 4074 * binder_apply_fd_fixups() - finish fd translation 4075 * @proc: binder_proc associated @t->buffer 4076 * @t: binder transaction with list of fd fixups 4077 * 4078 * Now that we are in the context of the transaction target 4079 * process, we can allocate and install fds. Process the 4080 * list of fds to translate and fixup the buffer with the 4081 * new fds first and only then install the files. 4082 * 4083 * If we fail to allocate an fd, skip the install and release 4084 * any fds that have already been allocated. 4085 */ 4086 static int binder_apply_fd_fixups(struct binder_proc *proc, 4087 struct binder_transaction *t) 4088 { 4089 struct binder_txn_fd_fixup *fixup, *tmp; 4090 int ret = 0; 4091 4092 list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) { 4093 int fd = get_unused_fd_flags(O_CLOEXEC); 4094 4095 if (fd < 0) { 4096 binder_debug(BINDER_DEBUG_TRANSACTION, 4097 "failed fd fixup txn %d fd %d\n", 4098 t->debug_id, fd); 4099 ret = -ENOMEM; 4100 goto err; 4101 } 4102 binder_debug(BINDER_DEBUG_TRANSACTION, 4103 "fd fixup txn %d fd %d\n", 4104 t->debug_id, fd); 4105 trace_binder_transaction_fd_recv(t, fd, fixup->offset); 4106 fixup->target_fd = fd; 4107 if (binder_alloc_copy_to_buffer(&proc->alloc, t->buffer, 4108 fixup->offset, &fd, 4109 sizeof(u32))) { 4110 ret = -EINVAL; 4111 goto err; 4112 } 4113 } 4114 list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) { 4115 fd_install(fixup->target_fd, fixup->file); 4116 list_del(&fixup->fixup_entry); 4117 kfree(fixup); 4118 } 4119 4120 return ret; 4121 4122 err: 4123 binder_free_txn_fixups(t); 4124 return ret; 4125 } 4126 4127 static int binder_thread_read(struct binder_proc *proc, 4128 struct binder_thread *thread, 4129 binder_uintptr_t binder_buffer, size_t size, 4130 binder_size_t *consumed, int non_block) 4131 { 4132 void __user *buffer = (void __user *)(uintptr_t)binder_buffer; 4133 void __user *ptr = buffer + *consumed; 4134 void __user *end = buffer + size; 4135 4136 int ret = 0; 4137 int wait_for_proc_work; 4138 4139 if (*consumed == 0) { 4140 if (put_user(BR_NOOP, (uint32_t __user *)ptr)) 4141 return -EFAULT; 4142 ptr += sizeof(uint32_t); 4143 } 4144 4145 retry: 4146 binder_inner_proc_lock(proc); 4147 wait_for_proc_work = binder_available_for_proc_work_ilocked(thread); 4148 binder_inner_proc_unlock(proc); 4149 4150 thread->looper |= BINDER_LOOPER_STATE_WAITING; 4151 4152 trace_binder_wait_for_work(wait_for_proc_work, 4153 !!thread->transaction_stack, 4154 !binder_worklist_empty(proc, &thread->todo)); 4155 if (wait_for_proc_work) { 4156 if (!(thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 4157 BINDER_LOOPER_STATE_ENTERED))) { 4158 binder_user_error("%d:%d ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state %x)\n", 4159 proc->pid, thread->pid, thread->looper); 4160 wait_event_interruptible(binder_user_error_wait, 4161 binder_stop_on_user_error < 2); 4162 } 4163 binder_set_nice(proc->default_priority); 4164 } 4165 4166 if (non_block) { 4167 if (!binder_has_work(thread, wait_for_proc_work)) 4168 ret = -EAGAIN; 4169 } else { 4170 ret = binder_wait_for_work(thread, wait_for_proc_work); 4171 } 4172 4173 thread->looper &= ~BINDER_LOOPER_STATE_WAITING; 4174 4175 if (ret) 4176 return ret; 4177 4178 while (1) { 4179 uint32_t cmd; 4180 struct binder_transaction_data_secctx tr; 4181 struct binder_transaction_data *trd = &tr.transaction_data; 4182 struct binder_work *w = NULL; 4183 struct list_head *list = NULL; 4184 struct binder_transaction *t = NULL; 4185 struct binder_thread *t_from; 4186 size_t trsize = sizeof(*trd); 4187 4188 binder_inner_proc_lock(proc); 4189 if (!binder_worklist_empty_ilocked(&thread->todo)) 4190 list = &thread->todo; 4191 else if (!binder_worklist_empty_ilocked(&proc->todo) && 4192 wait_for_proc_work) 4193 list = &proc->todo; 4194 else { 4195 binder_inner_proc_unlock(proc); 4196 4197 /* no data added */ 4198 if (ptr - buffer == 4 && !thread->looper_need_return) 4199 goto retry; 4200 break; 4201 } 4202 4203 if (end - ptr < sizeof(tr) + 4) { 4204 binder_inner_proc_unlock(proc); 4205 break; 4206 } 4207 w = binder_dequeue_work_head_ilocked(list); 4208 if (binder_worklist_empty_ilocked(&thread->todo)) 4209 thread->process_todo = false; 4210 4211 switch (w->type) { 4212 case BINDER_WORK_TRANSACTION: { 4213 binder_inner_proc_unlock(proc); 4214 t = container_of(w, struct binder_transaction, work); 4215 } break; 4216 case BINDER_WORK_RETURN_ERROR: { 4217 struct binder_error *e = container_of( 4218 w, struct binder_error, work); 4219 4220 WARN_ON(e->cmd == BR_OK); 4221 binder_inner_proc_unlock(proc); 4222 if (put_user(e->cmd, (uint32_t __user *)ptr)) 4223 return -EFAULT; 4224 cmd = e->cmd; 4225 e->cmd = BR_OK; 4226 ptr += sizeof(uint32_t); 4227 4228 binder_stat_br(proc, thread, cmd); 4229 } break; 4230 case BINDER_WORK_TRANSACTION_COMPLETE: 4231 case BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT: { 4232 if (proc->oneway_spam_detection_enabled && 4233 w->type == BINDER_WORK_TRANSACTION_ONEWAY_SPAM_SUSPECT) 4234 cmd = BR_ONEWAY_SPAM_SUSPECT; 4235 else 4236 cmd = BR_TRANSACTION_COMPLETE; 4237 binder_inner_proc_unlock(proc); 4238 kfree(w); 4239 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 4240 if (put_user(cmd, (uint32_t __user *)ptr)) 4241 return -EFAULT; 4242 ptr += sizeof(uint32_t); 4243 4244 binder_stat_br(proc, thread, cmd); 4245 binder_debug(BINDER_DEBUG_TRANSACTION_COMPLETE, 4246 "%d:%d BR_TRANSACTION_COMPLETE\n", 4247 proc->pid, thread->pid); 4248 } break; 4249 case BINDER_WORK_NODE: { 4250 struct binder_node *node = container_of(w, struct binder_node, work); 4251 int strong, weak; 4252 binder_uintptr_t node_ptr = node->ptr; 4253 binder_uintptr_t node_cookie = node->cookie; 4254 int node_debug_id = node->debug_id; 4255 int has_weak_ref; 4256 int has_strong_ref; 4257 void __user *orig_ptr = ptr; 4258 4259 BUG_ON(proc != node->proc); 4260 strong = node->internal_strong_refs || 4261 node->local_strong_refs; 4262 weak = !hlist_empty(&node->refs) || 4263 node->local_weak_refs || 4264 node->tmp_refs || strong; 4265 has_strong_ref = node->has_strong_ref; 4266 has_weak_ref = node->has_weak_ref; 4267 4268 if (weak && !has_weak_ref) { 4269 node->has_weak_ref = 1; 4270 node->pending_weak_ref = 1; 4271 node->local_weak_refs++; 4272 } 4273 if (strong && !has_strong_ref) { 4274 node->has_strong_ref = 1; 4275 node->pending_strong_ref = 1; 4276 node->local_strong_refs++; 4277 } 4278 if (!strong && has_strong_ref) 4279 node->has_strong_ref = 0; 4280 if (!weak && has_weak_ref) 4281 node->has_weak_ref = 0; 4282 if (!weak && !strong) { 4283 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 4284 "%d:%d node %d u%016llx c%016llx deleted\n", 4285 proc->pid, thread->pid, 4286 node_debug_id, 4287 (u64)node_ptr, 4288 (u64)node_cookie); 4289 rb_erase(&node->rb_node, &proc->nodes); 4290 binder_inner_proc_unlock(proc); 4291 binder_node_lock(node); 4292 /* 4293 * Acquire the node lock before freeing the 4294 * node to serialize with other threads that 4295 * may have been holding the node lock while 4296 * decrementing this node (avoids race where 4297 * this thread frees while the other thread 4298 * is unlocking the node after the final 4299 * decrement) 4300 */ 4301 binder_node_unlock(node); 4302 binder_free_node(node); 4303 } else 4304 binder_inner_proc_unlock(proc); 4305 4306 if (weak && !has_weak_ref) 4307 ret = binder_put_node_cmd( 4308 proc, thread, &ptr, node_ptr, 4309 node_cookie, node_debug_id, 4310 BR_INCREFS, "BR_INCREFS"); 4311 if (!ret && strong && !has_strong_ref) 4312 ret = binder_put_node_cmd( 4313 proc, thread, &ptr, node_ptr, 4314 node_cookie, node_debug_id, 4315 BR_ACQUIRE, "BR_ACQUIRE"); 4316 if (!ret && !strong && has_strong_ref) 4317 ret = binder_put_node_cmd( 4318 proc, thread, &ptr, node_ptr, 4319 node_cookie, node_debug_id, 4320 BR_RELEASE, "BR_RELEASE"); 4321 if (!ret && !weak && has_weak_ref) 4322 ret = binder_put_node_cmd( 4323 proc, thread, &ptr, node_ptr, 4324 node_cookie, node_debug_id, 4325 BR_DECREFS, "BR_DECREFS"); 4326 if (orig_ptr == ptr) 4327 binder_debug(BINDER_DEBUG_INTERNAL_REFS, 4328 "%d:%d node %d u%016llx c%016llx state unchanged\n", 4329 proc->pid, thread->pid, 4330 node_debug_id, 4331 (u64)node_ptr, 4332 (u64)node_cookie); 4333 if (ret) 4334 return ret; 4335 } break; 4336 case BINDER_WORK_DEAD_BINDER: 4337 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 4338 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 4339 struct binder_ref_death *death; 4340 uint32_t cmd; 4341 binder_uintptr_t cookie; 4342 4343 death = container_of(w, struct binder_ref_death, work); 4344 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) 4345 cmd = BR_CLEAR_DEATH_NOTIFICATION_DONE; 4346 else 4347 cmd = BR_DEAD_BINDER; 4348 cookie = death->cookie; 4349 4350 binder_debug(BINDER_DEBUG_DEATH_NOTIFICATION, 4351 "%d:%d %s %016llx\n", 4352 proc->pid, thread->pid, 4353 cmd == BR_DEAD_BINDER ? 4354 "BR_DEAD_BINDER" : 4355 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 4356 (u64)cookie); 4357 if (w->type == BINDER_WORK_CLEAR_DEATH_NOTIFICATION) { 4358 binder_inner_proc_unlock(proc); 4359 kfree(death); 4360 binder_stats_deleted(BINDER_STAT_DEATH); 4361 } else { 4362 binder_enqueue_work_ilocked( 4363 w, &proc->delivered_death); 4364 binder_inner_proc_unlock(proc); 4365 } 4366 if (put_user(cmd, (uint32_t __user *)ptr)) 4367 return -EFAULT; 4368 ptr += sizeof(uint32_t); 4369 if (put_user(cookie, 4370 (binder_uintptr_t __user *)ptr)) 4371 return -EFAULT; 4372 ptr += sizeof(binder_uintptr_t); 4373 binder_stat_br(proc, thread, cmd); 4374 if (cmd == BR_DEAD_BINDER) 4375 goto done; /* DEAD_BINDER notifications can cause transactions */ 4376 } break; 4377 default: 4378 binder_inner_proc_unlock(proc); 4379 pr_err("%d:%d: bad work type %d\n", 4380 proc->pid, thread->pid, w->type); 4381 break; 4382 } 4383 4384 if (!t) 4385 continue; 4386 4387 BUG_ON(t->buffer == NULL); 4388 if (t->buffer->target_node) { 4389 struct binder_node *target_node = t->buffer->target_node; 4390 4391 trd->target.ptr = target_node->ptr; 4392 trd->cookie = target_node->cookie; 4393 t->saved_priority = task_nice(current); 4394 if (t->priority < target_node->min_priority && 4395 !(t->flags & TF_ONE_WAY)) 4396 binder_set_nice(t->priority); 4397 else if (!(t->flags & TF_ONE_WAY) || 4398 t->saved_priority > target_node->min_priority) 4399 binder_set_nice(target_node->min_priority); 4400 cmd = BR_TRANSACTION; 4401 } else { 4402 trd->target.ptr = 0; 4403 trd->cookie = 0; 4404 cmd = BR_REPLY; 4405 } 4406 trd->code = t->code; 4407 trd->flags = t->flags; 4408 trd->sender_euid = from_kuid(current_user_ns(), t->sender_euid); 4409 4410 t_from = binder_get_txn_from(t); 4411 if (t_from) { 4412 struct task_struct *sender = t_from->proc->tsk; 4413 4414 trd->sender_pid = 4415 task_tgid_nr_ns(sender, 4416 task_active_pid_ns(current)); 4417 } else { 4418 trd->sender_pid = 0; 4419 } 4420 4421 ret = binder_apply_fd_fixups(proc, t); 4422 if (ret) { 4423 struct binder_buffer *buffer = t->buffer; 4424 bool oneway = !!(t->flags & TF_ONE_WAY); 4425 int tid = t->debug_id; 4426 4427 if (t_from) 4428 binder_thread_dec_tmpref(t_from); 4429 buffer->transaction = NULL; 4430 binder_cleanup_transaction(t, "fd fixups failed", 4431 BR_FAILED_REPLY); 4432 binder_free_buf(proc, thread, buffer, true); 4433 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, 4434 "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n", 4435 proc->pid, thread->pid, 4436 oneway ? "async " : 4437 (cmd == BR_REPLY ? "reply " : ""), 4438 tid, BR_FAILED_REPLY, ret, __LINE__); 4439 if (cmd == BR_REPLY) { 4440 cmd = BR_FAILED_REPLY; 4441 if (put_user(cmd, (uint32_t __user *)ptr)) 4442 return -EFAULT; 4443 ptr += sizeof(uint32_t); 4444 binder_stat_br(proc, thread, cmd); 4445 break; 4446 } 4447 continue; 4448 } 4449 trd->data_size = t->buffer->data_size; 4450 trd->offsets_size = t->buffer->offsets_size; 4451 trd->data.ptr.buffer = (uintptr_t)t->buffer->user_data; 4452 trd->data.ptr.offsets = trd->data.ptr.buffer + 4453 ALIGN(t->buffer->data_size, 4454 sizeof(void *)); 4455 4456 tr.secctx = t->security_ctx; 4457 if (t->security_ctx) { 4458 cmd = BR_TRANSACTION_SEC_CTX; 4459 trsize = sizeof(tr); 4460 } 4461 if (put_user(cmd, (uint32_t __user *)ptr)) { 4462 if (t_from) 4463 binder_thread_dec_tmpref(t_from); 4464 4465 binder_cleanup_transaction(t, "put_user failed", 4466 BR_FAILED_REPLY); 4467 4468 return -EFAULT; 4469 } 4470 ptr += sizeof(uint32_t); 4471 if (copy_to_user(ptr, &tr, trsize)) { 4472 if (t_from) 4473 binder_thread_dec_tmpref(t_from); 4474 4475 binder_cleanup_transaction(t, "copy_to_user failed", 4476 BR_FAILED_REPLY); 4477 4478 return -EFAULT; 4479 } 4480 ptr += trsize; 4481 4482 trace_binder_transaction_received(t); 4483 binder_stat_br(proc, thread, cmd); 4484 binder_debug(BINDER_DEBUG_TRANSACTION, 4485 "%d:%d %s %d %d:%d, cmd %d size %zd-%zd ptr %016llx-%016llx\n", 4486 proc->pid, thread->pid, 4487 (cmd == BR_TRANSACTION) ? "BR_TRANSACTION" : 4488 (cmd == BR_TRANSACTION_SEC_CTX) ? 4489 "BR_TRANSACTION_SEC_CTX" : "BR_REPLY", 4490 t->debug_id, t_from ? t_from->proc->pid : 0, 4491 t_from ? t_from->pid : 0, cmd, 4492 t->buffer->data_size, t->buffer->offsets_size, 4493 (u64)trd->data.ptr.buffer, 4494 (u64)trd->data.ptr.offsets); 4495 4496 if (t_from) 4497 binder_thread_dec_tmpref(t_from); 4498 t->buffer->allow_user_free = 1; 4499 if (cmd != BR_REPLY && !(t->flags & TF_ONE_WAY)) { 4500 binder_inner_proc_lock(thread->proc); 4501 t->to_parent = thread->transaction_stack; 4502 t->to_thread = thread; 4503 thread->transaction_stack = t; 4504 binder_inner_proc_unlock(thread->proc); 4505 } else { 4506 binder_free_transaction(t); 4507 } 4508 break; 4509 } 4510 4511 done: 4512 4513 *consumed = ptr - buffer; 4514 binder_inner_proc_lock(proc); 4515 if (proc->requested_threads == 0 && 4516 list_empty(&thread->proc->waiting_threads) && 4517 proc->requested_threads_started < proc->max_threads && 4518 (thread->looper & (BINDER_LOOPER_STATE_REGISTERED | 4519 BINDER_LOOPER_STATE_ENTERED)) /* the user-space code fails to */ 4520 /*spawn a new thread if we leave this out */) { 4521 proc->requested_threads++; 4522 binder_inner_proc_unlock(proc); 4523 binder_debug(BINDER_DEBUG_THREADS, 4524 "%d:%d BR_SPAWN_LOOPER\n", 4525 proc->pid, thread->pid); 4526 if (put_user(BR_SPAWN_LOOPER, (uint32_t __user *)buffer)) 4527 return -EFAULT; 4528 binder_stat_br(proc, thread, BR_SPAWN_LOOPER); 4529 } else 4530 binder_inner_proc_unlock(proc); 4531 return 0; 4532 } 4533 4534 static void binder_release_work(struct binder_proc *proc, 4535 struct list_head *list) 4536 { 4537 struct binder_work *w; 4538 enum binder_work_type wtype; 4539 4540 while (1) { 4541 binder_inner_proc_lock(proc); 4542 w = binder_dequeue_work_head_ilocked(list); 4543 wtype = w ? w->type : 0; 4544 binder_inner_proc_unlock(proc); 4545 if (!w) 4546 return; 4547 4548 switch (wtype) { 4549 case BINDER_WORK_TRANSACTION: { 4550 struct binder_transaction *t; 4551 4552 t = container_of(w, struct binder_transaction, work); 4553 4554 binder_cleanup_transaction(t, "process died.", 4555 BR_DEAD_REPLY); 4556 } break; 4557 case BINDER_WORK_RETURN_ERROR: { 4558 struct binder_error *e = container_of( 4559 w, struct binder_error, work); 4560 4561 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 4562 "undelivered TRANSACTION_ERROR: %u\n", 4563 e->cmd); 4564 } break; 4565 case BINDER_WORK_TRANSACTION_COMPLETE: { 4566 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 4567 "undelivered TRANSACTION_COMPLETE\n"); 4568 kfree(w); 4569 binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); 4570 } break; 4571 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 4572 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { 4573 struct binder_ref_death *death; 4574 4575 death = container_of(w, struct binder_ref_death, work); 4576 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 4577 "undelivered death notification, %016llx\n", 4578 (u64)death->cookie); 4579 kfree(death); 4580 binder_stats_deleted(BINDER_STAT_DEATH); 4581 } break; 4582 case BINDER_WORK_NODE: 4583 break; 4584 default: 4585 pr_err("unexpected work type, %d, not freed\n", 4586 wtype); 4587 break; 4588 } 4589 } 4590 4591 } 4592 4593 static struct binder_thread *binder_get_thread_ilocked( 4594 struct binder_proc *proc, struct binder_thread *new_thread) 4595 { 4596 struct binder_thread *thread = NULL; 4597 struct rb_node *parent = NULL; 4598 struct rb_node **p = &proc->threads.rb_node; 4599 4600 while (*p) { 4601 parent = *p; 4602 thread = rb_entry(parent, struct binder_thread, rb_node); 4603 4604 if (current->pid < thread->pid) 4605 p = &(*p)->rb_left; 4606 else if (current->pid > thread->pid) 4607 p = &(*p)->rb_right; 4608 else 4609 return thread; 4610 } 4611 if (!new_thread) 4612 return NULL; 4613 thread = new_thread; 4614 binder_stats_created(BINDER_STAT_THREAD); 4615 thread->proc = proc; 4616 thread->pid = current->pid; 4617 atomic_set(&thread->tmp_ref, 0); 4618 init_waitqueue_head(&thread->wait); 4619 INIT_LIST_HEAD(&thread->todo); 4620 rb_link_node(&thread->rb_node, parent, p); 4621 rb_insert_color(&thread->rb_node, &proc->threads); 4622 thread->looper_need_return = true; 4623 thread->return_error.work.type = BINDER_WORK_RETURN_ERROR; 4624 thread->return_error.cmd = BR_OK; 4625 thread->reply_error.work.type = BINDER_WORK_RETURN_ERROR; 4626 thread->reply_error.cmd = BR_OK; 4627 INIT_LIST_HEAD(&new_thread->waiting_thread_node); 4628 return thread; 4629 } 4630 4631 static struct binder_thread *binder_get_thread(struct binder_proc *proc) 4632 { 4633 struct binder_thread *thread; 4634 struct binder_thread *new_thread; 4635 4636 binder_inner_proc_lock(proc); 4637 thread = binder_get_thread_ilocked(proc, NULL); 4638 binder_inner_proc_unlock(proc); 4639 if (!thread) { 4640 new_thread = kzalloc(sizeof(*thread), GFP_KERNEL); 4641 if (new_thread == NULL) 4642 return NULL; 4643 binder_inner_proc_lock(proc); 4644 thread = binder_get_thread_ilocked(proc, new_thread); 4645 binder_inner_proc_unlock(proc); 4646 if (thread != new_thread) 4647 kfree(new_thread); 4648 } 4649 return thread; 4650 } 4651 4652 static void binder_free_proc(struct binder_proc *proc) 4653 { 4654 struct binder_device *device; 4655 4656 BUG_ON(!list_empty(&proc->todo)); 4657 BUG_ON(!list_empty(&proc->delivered_death)); 4658 if (proc->outstanding_txns) 4659 pr_warn("%s: Unexpected outstanding_txns %d\n", 4660 __func__, proc->outstanding_txns); 4661 device = container_of(proc->context, struct binder_device, context); 4662 if (refcount_dec_and_test(&device->ref)) { 4663 kfree(proc->context->name); 4664 kfree(device); 4665 } 4666 binder_alloc_deferred_release(&proc->alloc); 4667 put_task_struct(proc->tsk); 4668 put_cred(proc->cred); 4669 binder_stats_deleted(BINDER_STAT_PROC); 4670 kfree(proc); 4671 } 4672 4673 static void binder_free_thread(struct binder_thread *thread) 4674 { 4675 BUG_ON(!list_empty(&thread->todo)); 4676 binder_stats_deleted(BINDER_STAT_THREAD); 4677 binder_proc_dec_tmpref(thread->proc); 4678 kfree(thread); 4679 } 4680 4681 static int binder_thread_release(struct binder_proc *proc, 4682 struct binder_thread *thread) 4683 { 4684 struct binder_transaction *t; 4685 struct binder_transaction *send_reply = NULL; 4686 int active_transactions = 0; 4687 struct binder_transaction *last_t = NULL; 4688 4689 binder_inner_proc_lock(thread->proc); 4690 /* 4691 * take a ref on the proc so it survives 4692 * after we remove this thread from proc->threads. 4693 * The corresponding dec is when we actually 4694 * free the thread in binder_free_thread() 4695 */ 4696 proc->tmp_ref++; 4697 /* 4698 * take a ref on this thread to ensure it 4699 * survives while we are releasing it 4700 */ 4701 atomic_inc(&thread->tmp_ref); 4702 rb_erase(&thread->rb_node, &proc->threads); 4703 t = thread->transaction_stack; 4704 if (t) { 4705 spin_lock(&t->lock); 4706 if (t->to_thread == thread) 4707 send_reply = t; 4708 } else { 4709 __acquire(&t->lock); 4710 } 4711 thread->is_dead = true; 4712 4713 while (t) { 4714 last_t = t; 4715 active_transactions++; 4716 binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, 4717 "release %d:%d transaction %d %s, still active\n", 4718 proc->pid, thread->pid, 4719 t->debug_id, 4720 (t->to_thread == thread) ? "in" : "out"); 4721 4722 if (t->to_thread == thread) { 4723 thread->proc->outstanding_txns--; 4724 t->to_proc = NULL; 4725 t->to_thread = NULL; 4726 if (t->buffer) { 4727 t->buffer->transaction = NULL; 4728 t->buffer = NULL; 4729 } 4730 t = t->to_parent; 4731 } else if (t->from == thread) { 4732 t->from = NULL; 4733 t = t->from_parent; 4734 } else 4735 BUG(); 4736 spin_unlock(&last_t->lock); 4737 if (t) 4738 spin_lock(&t->lock); 4739 else 4740 __acquire(&t->lock); 4741 } 4742 /* annotation for sparse, lock not acquired in last iteration above */ 4743 __release(&t->lock); 4744 4745 /* 4746 * If this thread used poll, make sure we remove the waitqueue from any 4747 * poll data structures holding it. 4748 */ 4749 if (thread->looper & BINDER_LOOPER_STATE_POLL) 4750 wake_up_pollfree(&thread->wait); 4751 4752 binder_inner_proc_unlock(thread->proc); 4753 4754 /* 4755 * This is needed to avoid races between wake_up_pollfree() above and 4756 * someone else removing the last entry from the queue for other reasons 4757 * (e.g. ep_remove_wait_queue() being called due to an epoll file 4758 * descriptor being closed). Such other users hold an RCU read lock, so 4759 * we can be sure they're done after we call synchronize_rcu(). 4760 */ 4761 if (thread->looper & BINDER_LOOPER_STATE_POLL) 4762 synchronize_rcu(); 4763 4764 if (send_reply) 4765 binder_send_failed_reply(send_reply, BR_DEAD_REPLY); 4766 binder_release_work(proc, &thread->todo); 4767 binder_thread_dec_tmpref(thread); 4768 return active_transactions; 4769 } 4770 4771 static __poll_t binder_poll(struct file *filp, 4772 struct poll_table_struct *wait) 4773 { 4774 struct binder_proc *proc = filp->private_data; 4775 struct binder_thread *thread = NULL; 4776 bool wait_for_proc_work; 4777 4778 thread = binder_get_thread(proc); 4779 if (!thread) 4780 return POLLERR; 4781 4782 binder_inner_proc_lock(thread->proc); 4783 thread->looper |= BINDER_LOOPER_STATE_POLL; 4784 wait_for_proc_work = binder_available_for_proc_work_ilocked(thread); 4785 4786 binder_inner_proc_unlock(thread->proc); 4787 4788 poll_wait(filp, &thread->wait, wait); 4789 4790 if (binder_has_work(thread, wait_for_proc_work)) 4791 return EPOLLIN; 4792 4793 return 0; 4794 } 4795 4796 static int binder_ioctl_write_read(struct file *filp, 4797 unsigned int cmd, unsigned long arg, 4798 struct binder_thread *thread) 4799 { 4800 int ret = 0; 4801 struct binder_proc *proc = filp->private_data; 4802 unsigned int size = _IOC_SIZE(cmd); 4803 void __user *ubuf = (void __user *)arg; 4804 struct binder_write_read bwr; 4805 4806 if (size != sizeof(struct binder_write_read)) { 4807 ret = -EINVAL; 4808 goto out; 4809 } 4810 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 4811 ret = -EFAULT; 4812 goto out; 4813 } 4814 binder_debug(BINDER_DEBUG_READ_WRITE, 4815 "%d:%d write %lld at %016llx, read %lld at %016llx\n", 4816 proc->pid, thread->pid, 4817 (u64)bwr.write_size, (u64)bwr.write_buffer, 4818 (u64)bwr.read_size, (u64)bwr.read_buffer); 4819 4820 if (bwr.write_size > 0) { 4821 ret = binder_thread_write(proc, thread, 4822 bwr.write_buffer, 4823 bwr.write_size, 4824 &bwr.write_consumed); 4825 trace_binder_write_done(ret); 4826 if (ret < 0) { 4827 bwr.read_consumed = 0; 4828 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 4829 ret = -EFAULT; 4830 goto out; 4831 } 4832 } 4833 if (bwr.read_size > 0) { 4834 ret = binder_thread_read(proc, thread, bwr.read_buffer, 4835 bwr.read_size, 4836 &bwr.read_consumed, 4837 filp->f_flags & O_NONBLOCK); 4838 trace_binder_read_done(ret); 4839 binder_inner_proc_lock(proc); 4840 if (!binder_worklist_empty_ilocked(&proc->todo)) 4841 binder_wakeup_proc_ilocked(proc); 4842 binder_inner_proc_unlock(proc); 4843 if (ret < 0) { 4844 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) 4845 ret = -EFAULT; 4846 goto out; 4847 } 4848 } 4849 binder_debug(BINDER_DEBUG_READ_WRITE, 4850 "%d:%d wrote %lld of %lld, read return %lld of %lld\n", 4851 proc->pid, thread->pid, 4852 (u64)bwr.write_consumed, (u64)bwr.write_size, 4853 (u64)bwr.read_consumed, (u64)bwr.read_size); 4854 if (copy_to_user(ubuf, &bwr, sizeof(bwr))) { 4855 ret = -EFAULT; 4856 goto out; 4857 } 4858 out: 4859 return ret; 4860 } 4861 4862 static int binder_ioctl_set_ctx_mgr(struct file *filp, 4863 struct flat_binder_object *fbo) 4864 { 4865 int ret = 0; 4866 struct binder_proc *proc = filp->private_data; 4867 struct binder_context *context = proc->context; 4868 struct binder_node *new_node; 4869 kuid_t curr_euid = current_euid(); 4870 4871 mutex_lock(&context->context_mgr_node_lock); 4872 if (context->binder_context_mgr_node) { 4873 pr_err("BINDER_SET_CONTEXT_MGR already set\n"); 4874 ret = -EBUSY; 4875 goto out; 4876 } 4877 ret = security_binder_set_context_mgr(proc->cred); 4878 if (ret < 0) 4879 goto out; 4880 if (uid_valid(context->binder_context_mgr_uid)) { 4881 if (!uid_eq(context->binder_context_mgr_uid, curr_euid)) { 4882 pr_err("BINDER_SET_CONTEXT_MGR bad uid %d != %d\n", 4883 from_kuid(&init_user_ns, curr_euid), 4884 from_kuid(&init_user_ns, 4885 context->binder_context_mgr_uid)); 4886 ret = -EPERM; 4887 goto out; 4888 } 4889 } else { 4890 context->binder_context_mgr_uid = curr_euid; 4891 } 4892 new_node = binder_new_node(proc, fbo); 4893 if (!new_node) { 4894 ret = -ENOMEM; 4895 goto out; 4896 } 4897 binder_node_lock(new_node); 4898 new_node->local_weak_refs++; 4899 new_node->local_strong_refs++; 4900 new_node->has_strong_ref = 1; 4901 new_node->has_weak_ref = 1; 4902 context->binder_context_mgr_node = new_node; 4903 binder_node_unlock(new_node); 4904 binder_put_node(new_node); 4905 out: 4906 mutex_unlock(&context->context_mgr_node_lock); 4907 return ret; 4908 } 4909 4910 static int binder_ioctl_get_node_info_for_ref(struct binder_proc *proc, 4911 struct binder_node_info_for_ref *info) 4912 { 4913 struct binder_node *node; 4914 struct binder_context *context = proc->context; 4915 __u32 handle = info->handle; 4916 4917 if (info->strong_count || info->weak_count || info->reserved1 || 4918 info->reserved2 || info->reserved3) { 4919 binder_user_error("%d BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.", 4920 proc->pid); 4921 return -EINVAL; 4922 } 4923 4924 /* This ioctl may only be used by the context manager */ 4925 mutex_lock(&context->context_mgr_node_lock); 4926 if (!context->binder_context_mgr_node || 4927 context->binder_context_mgr_node->proc != proc) { 4928 mutex_unlock(&context->context_mgr_node_lock); 4929 return -EPERM; 4930 } 4931 mutex_unlock(&context->context_mgr_node_lock); 4932 4933 node = binder_get_node_from_ref(proc, handle, true, NULL); 4934 if (!node) 4935 return -EINVAL; 4936 4937 info->strong_count = node->local_strong_refs + 4938 node->internal_strong_refs; 4939 info->weak_count = node->local_weak_refs; 4940 4941 binder_put_node(node); 4942 4943 return 0; 4944 } 4945 4946 static int binder_ioctl_get_node_debug_info(struct binder_proc *proc, 4947 struct binder_node_debug_info *info) 4948 { 4949 struct rb_node *n; 4950 binder_uintptr_t ptr = info->ptr; 4951 4952 memset(info, 0, sizeof(*info)); 4953 4954 binder_inner_proc_lock(proc); 4955 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 4956 struct binder_node *node = rb_entry(n, struct binder_node, 4957 rb_node); 4958 if (node->ptr > ptr) { 4959 info->ptr = node->ptr; 4960 info->cookie = node->cookie; 4961 info->has_strong_ref = node->has_strong_ref; 4962 info->has_weak_ref = node->has_weak_ref; 4963 break; 4964 } 4965 } 4966 binder_inner_proc_unlock(proc); 4967 4968 return 0; 4969 } 4970 4971 static bool binder_txns_pending_ilocked(struct binder_proc *proc) 4972 { 4973 struct rb_node *n; 4974 struct binder_thread *thread; 4975 4976 if (proc->outstanding_txns > 0) 4977 return true; 4978 4979 for (n = rb_first(&proc->threads); n; n = rb_next(n)) { 4980 thread = rb_entry(n, struct binder_thread, rb_node); 4981 if (thread->transaction_stack) 4982 return true; 4983 } 4984 return false; 4985 } 4986 4987 static int binder_ioctl_freeze(struct binder_freeze_info *info, 4988 struct binder_proc *target_proc) 4989 { 4990 int ret = 0; 4991 4992 if (!info->enable) { 4993 binder_inner_proc_lock(target_proc); 4994 target_proc->sync_recv = false; 4995 target_proc->async_recv = false; 4996 target_proc->is_frozen = false; 4997 binder_inner_proc_unlock(target_proc); 4998 return 0; 4999 } 5000 5001 /* 5002 * Freezing the target. Prevent new transactions by 5003 * setting frozen state. If timeout specified, wait 5004 * for transactions to drain. 5005 */ 5006 binder_inner_proc_lock(target_proc); 5007 target_proc->sync_recv = false; 5008 target_proc->async_recv = false; 5009 target_proc->is_frozen = true; 5010 binder_inner_proc_unlock(target_proc); 5011 5012 if (info->timeout_ms > 0) 5013 ret = wait_event_interruptible_timeout( 5014 target_proc->freeze_wait, 5015 (!target_proc->outstanding_txns), 5016 msecs_to_jiffies(info->timeout_ms)); 5017 5018 /* Check pending transactions that wait for reply */ 5019 if (ret >= 0) { 5020 binder_inner_proc_lock(target_proc); 5021 if (binder_txns_pending_ilocked(target_proc)) 5022 ret = -EAGAIN; 5023 binder_inner_proc_unlock(target_proc); 5024 } 5025 5026 if (ret < 0) { 5027 binder_inner_proc_lock(target_proc); 5028 target_proc->is_frozen = false; 5029 binder_inner_proc_unlock(target_proc); 5030 } 5031 5032 return ret; 5033 } 5034 5035 static int binder_ioctl_get_freezer_info( 5036 struct binder_frozen_status_info *info) 5037 { 5038 struct binder_proc *target_proc; 5039 bool found = false; 5040 __u32 txns_pending; 5041 5042 info->sync_recv = 0; 5043 info->async_recv = 0; 5044 5045 mutex_lock(&binder_procs_lock); 5046 hlist_for_each_entry(target_proc, &binder_procs, proc_node) { 5047 if (target_proc->pid == info->pid) { 5048 found = true; 5049 binder_inner_proc_lock(target_proc); 5050 txns_pending = binder_txns_pending_ilocked(target_proc); 5051 info->sync_recv |= target_proc->sync_recv | 5052 (txns_pending << 1); 5053 info->async_recv |= target_proc->async_recv; 5054 binder_inner_proc_unlock(target_proc); 5055 } 5056 } 5057 mutex_unlock(&binder_procs_lock); 5058 5059 if (!found) 5060 return -EINVAL; 5061 5062 return 0; 5063 } 5064 5065 static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 5066 { 5067 int ret; 5068 struct binder_proc *proc = filp->private_data; 5069 struct binder_thread *thread; 5070 unsigned int size = _IOC_SIZE(cmd); 5071 void __user *ubuf = (void __user *)arg; 5072 5073 /*pr_info("binder_ioctl: %d:%d %x %lx\n", 5074 proc->pid, current->pid, cmd, arg);*/ 5075 5076 binder_selftest_alloc(&proc->alloc); 5077 5078 trace_binder_ioctl(cmd, arg); 5079 5080 ret = wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 5081 if (ret) 5082 goto err_unlocked; 5083 5084 thread = binder_get_thread(proc); 5085 if (thread == NULL) { 5086 ret = -ENOMEM; 5087 goto err; 5088 } 5089 5090 switch (cmd) { 5091 case BINDER_WRITE_READ: 5092 ret = binder_ioctl_write_read(filp, cmd, arg, thread); 5093 if (ret) 5094 goto err; 5095 break; 5096 case BINDER_SET_MAX_THREADS: { 5097 int max_threads; 5098 5099 if (copy_from_user(&max_threads, ubuf, 5100 sizeof(max_threads))) { 5101 ret = -EINVAL; 5102 goto err; 5103 } 5104 binder_inner_proc_lock(proc); 5105 proc->max_threads = max_threads; 5106 binder_inner_proc_unlock(proc); 5107 break; 5108 } 5109 case BINDER_SET_CONTEXT_MGR_EXT: { 5110 struct flat_binder_object fbo; 5111 5112 if (copy_from_user(&fbo, ubuf, sizeof(fbo))) { 5113 ret = -EINVAL; 5114 goto err; 5115 } 5116 ret = binder_ioctl_set_ctx_mgr(filp, &fbo); 5117 if (ret) 5118 goto err; 5119 break; 5120 } 5121 case BINDER_SET_CONTEXT_MGR: 5122 ret = binder_ioctl_set_ctx_mgr(filp, NULL); 5123 if (ret) 5124 goto err; 5125 break; 5126 case BINDER_THREAD_EXIT: 5127 binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n", 5128 proc->pid, thread->pid); 5129 binder_thread_release(proc, thread); 5130 thread = NULL; 5131 break; 5132 case BINDER_VERSION: { 5133 struct binder_version __user *ver = ubuf; 5134 5135 if (size != sizeof(struct binder_version)) { 5136 ret = -EINVAL; 5137 goto err; 5138 } 5139 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 5140 &ver->protocol_version)) { 5141 ret = -EINVAL; 5142 goto err; 5143 } 5144 break; 5145 } 5146 case BINDER_GET_NODE_INFO_FOR_REF: { 5147 struct binder_node_info_for_ref info; 5148 5149 if (copy_from_user(&info, ubuf, sizeof(info))) { 5150 ret = -EFAULT; 5151 goto err; 5152 } 5153 5154 ret = binder_ioctl_get_node_info_for_ref(proc, &info); 5155 if (ret < 0) 5156 goto err; 5157 5158 if (copy_to_user(ubuf, &info, sizeof(info))) { 5159 ret = -EFAULT; 5160 goto err; 5161 } 5162 5163 break; 5164 } 5165 case BINDER_GET_NODE_DEBUG_INFO: { 5166 struct binder_node_debug_info info; 5167 5168 if (copy_from_user(&info, ubuf, sizeof(info))) { 5169 ret = -EFAULT; 5170 goto err; 5171 } 5172 5173 ret = binder_ioctl_get_node_debug_info(proc, &info); 5174 if (ret < 0) 5175 goto err; 5176 5177 if (copy_to_user(ubuf, &info, sizeof(info))) { 5178 ret = -EFAULT; 5179 goto err; 5180 } 5181 break; 5182 } 5183 case BINDER_FREEZE: { 5184 struct binder_freeze_info info; 5185 struct binder_proc **target_procs = NULL, *target_proc; 5186 int target_procs_count = 0, i = 0; 5187 5188 ret = 0; 5189 5190 if (copy_from_user(&info, ubuf, sizeof(info))) { 5191 ret = -EFAULT; 5192 goto err; 5193 } 5194 5195 mutex_lock(&binder_procs_lock); 5196 hlist_for_each_entry(target_proc, &binder_procs, proc_node) { 5197 if (target_proc->pid == info.pid) 5198 target_procs_count++; 5199 } 5200 5201 if (target_procs_count == 0) { 5202 mutex_unlock(&binder_procs_lock); 5203 ret = -EINVAL; 5204 goto err; 5205 } 5206 5207 target_procs = kcalloc(target_procs_count, 5208 sizeof(struct binder_proc *), 5209 GFP_KERNEL); 5210 5211 if (!target_procs) { 5212 mutex_unlock(&binder_procs_lock); 5213 ret = -ENOMEM; 5214 goto err; 5215 } 5216 5217 hlist_for_each_entry(target_proc, &binder_procs, proc_node) { 5218 if (target_proc->pid != info.pid) 5219 continue; 5220 5221 binder_inner_proc_lock(target_proc); 5222 target_proc->tmp_ref++; 5223 binder_inner_proc_unlock(target_proc); 5224 5225 target_procs[i++] = target_proc; 5226 } 5227 mutex_unlock(&binder_procs_lock); 5228 5229 for (i = 0; i < target_procs_count; i++) { 5230 if (ret >= 0) 5231 ret = binder_ioctl_freeze(&info, 5232 target_procs[i]); 5233 5234 binder_proc_dec_tmpref(target_procs[i]); 5235 } 5236 5237 kfree(target_procs); 5238 5239 if (ret < 0) 5240 goto err; 5241 break; 5242 } 5243 case BINDER_GET_FROZEN_INFO: { 5244 struct binder_frozen_status_info info; 5245 5246 if (copy_from_user(&info, ubuf, sizeof(info))) { 5247 ret = -EFAULT; 5248 goto err; 5249 } 5250 5251 ret = binder_ioctl_get_freezer_info(&info); 5252 if (ret < 0) 5253 goto err; 5254 5255 if (copy_to_user(ubuf, &info, sizeof(info))) { 5256 ret = -EFAULT; 5257 goto err; 5258 } 5259 break; 5260 } 5261 case BINDER_ENABLE_ONEWAY_SPAM_DETECTION: { 5262 uint32_t enable; 5263 5264 if (copy_from_user(&enable, ubuf, sizeof(enable))) { 5265 ret = -EFAULT; 5266 goto err; 5267 } 5268 binder_inner_proc_lock(proc); 5269 proc->oneway_spam_detection_enabled = (bool)enable; 5270 binder_inner_proc_unlock(proc); 5271 break; 5272 } 5273 default: 5274 ret = -EINVAL; 5275 goto err; 5276 } 5277 ret = 0; 5278 err: 5279 if (thread) 5280 thread->looper_need_return = false; 5281 wait_event_interruptible(binder_user_error_wait, binder_stop_on_user_error < 2); 5282 if (ret && ret != -EINTR) 5283 pr_info("%d:%d ioctl %x %lx returned %d\n", proc->pid, current->pid, cmd, arg, ret); 5284 err_unlocked: 5285 trace_binder_ioctl_done(ret); 5286 return ret; 5287 } 5288 5289 static void binder_vma_open(struct vm_area_struct *vma) 5290 { 5291 struct binder_proc *proc = vma->vm_private_data; 5292 5293 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 5294 "%d open vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 5295 proc->pid, vma->vm_start, vma->vm_end, 5296 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 5297 (unsigned long)pgprot_val(vma->vm_page_prot)); 5298 } 5299 5300 static void binder_vma_close(struct vm_area_struct *vma) 5301 { 5302 struct binder_proc *proc = vma->vm_private_data; 5303 5304 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 5305 "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", 5306 proc->pid, vma->vm_start, vma->vm_end, 5307 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 5308 (unsigned long)pgprot_val(vma->vm_page_prot)); 5309 binder_alloc_vma_close(&proc->alloc); 5310 } 5311 5312 static vm_fault_t binder_vm_fault(struct vm_fault *vmf) 5313 { 5314 return VM_FAULT_SIGBUS; 5315 } 5316 5317 static const struct vm_operations_struct binder_vm_ops = { 5318 .open = binder_vma_open, 5319 .close = binder_vma_close, 5320 .fault = binder_vm_fault, 5321 }; 5322 5323 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 5324 { 5325 struct binder_proc *proc = filp->private_data; 5326 5327 if (proc->tsk != current->group_leader) 5328 return -EINVAL; 5329 5330 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 5331 "%s: %d %lx-%lx (%ld K) vma %lx pagep %lx\n", 5332 __func__, proc->pid, vma->vm_start, vma->vm_end, 5333 (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags, 5334 (unsigned long)pgprot_val(vma->vm_page_prot)); 5335 5336 if (vma->vm_flags & FORBIDDEN_MMAP_FLAGS) { 5337 pr_err("%s: %d %lx-%lx %s failed %d\n", __func__, 5338 proc->pid, vma->vm_start, vma->vm_end, "bad vm_flags", -EPERM); 5339 return -EPERM; 5340 } 5341 vma->vm_flags |= VM_DONTCOPY | VM_MIXEDMAP; 5342 vma->vm_flags &= ~VM_MAYWRITE; 5343 5344 vma->vm_ops = &binder_vm_ops; 5345 vma->vm_private_data = proc; 5346 5347 return binder_alloc_mmap_handler(&proc->alloc, vma); 5348 } 5349 5350 static int binder_open(struct inode *nodp, struct file *filp) 5351 { 5352 struct binder_proc *proc, *itr; 5353 struct binder_device *binder_dev; 5354 struct binderfs_info *info; 5355 struct dentry *binder_binderfs_dir_entry_proc = NULL; 5356 bool existing_pid = false; 5357 5358 binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%s: %d:%d\n", __func__, 5359 current->group_leader->pid, current->pid); 5360 5361 proc = kzalloc(sizeof(*proc), GFP_KERNEL); 5362 if (proc == NULL) 5363 return -ENOMEM; 5364 spin_lock_init(&proc->inner_lock); 5365 spin_lock_init(&proc->outer_lock); 5366 get_task_struct(current->group_leader); 5367 proc->tsk = current->group_leader; 5368 proc->cred = get_cred(filp->f_cred); 5369 INIT_LIST_HEAD(&proc->todo); 5370 init_waitqueue_head(&proc->freeze_wait); 5371 proc->default_priority = task_nice(current); 5372 /* binderfs stashes devices in i_private */ 5373 if (is_binderfs_device(nodp)) { 5374 binder_dev = nodp->i_private; 5375 info = nodp->i_sb->s_fs_info; 5376 binder_binderfs_dir_entry_proc = info->proc_log_dir; 5377 } else { 5378 binder_dev = container_of(filp->private_data, 5379 struct binder_device, miscdev); 5380 } 5381 refcount_inc(&binder_dev->ref); 5382 proc->context = &binder_dev->context; 5383 binder_alloc_init(&proc->alloc); 5384 5385 binder_stats_created(BINDER_STAT_PROC); 5386 proc->pid = current->group_leader->pid; 5387 INIT_LIST_HEAD(&proc->delivered_death); 5388 INIT_LIST_HEAD(&proc->waiting_threads); 5389 filp->private_data = proc; 5390 5391 mutex_lock(&binder_procs_lock); 5392 hlist_for_each_entry(itr, &binder_procs, proc_node) { 5393 if (itr->pid == proc->pid) { 5394 existing_pid = true; 5395 break; 5396 } 5397 } 5398 hlist_add_head(&proc->proc_node, &binder_procs); 5399 mutex_unlock(&binder_procs_lock); 5400 5401 if (binder_debugfs_dir_entry_proc && !existing_pid) { 5402 char strbuf[11]; 5403 5404 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 5405 /* 5406 * proc debug entries are shared between contexts. 5407 * Only create for the first PID to avoid debugfs log spamming 5408 * The printing code will anyway print all contexts for a given 5409 * PID so this is not a problem. 5410 */ 5411 proc->debugfs_entry = debugfs_create_file(strbuf, 0444, 5412 binder_debugfs_dir_entry_proc, 5413 (void *)(unsigned long)proc->pid, 5414 &proc_fops); 5415 } 5416 5417 if (binder_binderfs_dir_entry_proc && !existing_pid) { 5418 char strbuf[11]; 5419 struct dentry *binderfs_entry; 5420 5421 snprintf(strbuf, sizeof(strbuf), "%u", proc->pid); 5422 /* 5423 * Similar to debugfs, the process specific log file is shared 5424 * between contexts. Only create for the first PID. 5425 * This is ok since same as debugfs, the log file will contain 5426 * information on all contexts of a given PID. 5427 */ 5428 binderfs_entry = binderfs_create_file(binder_binderfs_dir_entry_proc, 5429 strbuf, &proc_fops, (void *)(unsigned long)proc->pid); 5430 if (!IS_ERR(binderfs_entry)) { 5431 proc->binderfs_entry = binderfs_entry; 5432 } else { 5433 int error; 5434 5435 error = PTR_ERR(binderfs_entry); 5436 pr_warn("Unable to create file %s in binderfs (error %d)\n", 5437 strbuf, error); 5438 } 5439 } 5440 5441 return 0; 5442 } 5443 5444 static int binder_flush(struct file *filp, fl_owner_t id) 5445 { 5446 struct binder_proc *proc = filp->private_data; 5447 5448 binder_defer_work(proc, BINDER_DEFERRED_FLUSH); 5449 5450 return 0; 5451 } 5452 5453 static void binder_deferred_flush(struct binder_proc *proc) 5454 { 5455 struct rb_node *n; 5456 int wake_count = 0; 5457 5458 binder_inner_proc_lock(proc); 5459 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) { 5460 struct binder_thread *thread = rb_entry(n, struct binder_thread, rb_node); 5461 5462 thread->looper_need_return = true; 5463 if (thread->looper & BINDER_LOOPER_STATE_WAITING) { 5464 wake_up_interruptible(&thread->wait); 5465 wake_count++; 5466 } 5467 } 5468 binder_inner_proc_unlock(proc); 5469 5470 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 5471 "binder_flush: %d woke %d threads\n", proc->pid, 5472 wake_count); 5473 } 5474 5475 static int binder_release(struct inode *nodp, struct file *filp) 5476 { 5477 struct binder_proc *proc = filp->private_data; 5478 5479 debugfs_remove(proc->debugfs_entry); 5480 5481 if (proc->binderfs_entry) { 5482 binderfs_remove_file(proc->binderfs_entry); 5483 proc->binderfs_entry = NULL; 5484 } 5485 5486 binder_defer_work(proc, BINDER_DEFERRED_RELEASE); 5487 5488 return 0; 5489 } 5490 5491 static int binder_node_release(struct binder_node *node, int refs) 5492 { 5493 struct binder_ref *ref; 5494 int death = 0; 5495 struct binder_proc *proc = node->proc; 5496 5497 binder_release_work(proc, &node->async_todo); 5498 5499 binder_node_lock(node); 5500 binder_inner_proc_lock(proc); 5501 binder_dequeue_work_ilocked(&node->work); 5502 /* 5503 * The caller must have taken a temporary ref on the node, 5504 */ 5505 BUG_ON(!node->tmp_refs); 5506 if (hlist_empty(&node->refs) && node->tmp_refs == 1) { 5507 binder_inner_proc_unlock(proc); 5508 binder_node_unlock(node); 5509 binder_free_node(node); 5510 5511 return refs; 5512 } 5513 5514 node->proc = NULL; 5515 node->local_strong_refs = 0; 5516 node->local_weak_refs = 0; 5517 binder_inner_proc_unlock(proc); 5518 5519 spin_lock(&binder_dead_nodes_lock); 5520 hlist_add_head(&node->dead_node, &binder_dead_nodes); 5521 spin_unlock(&binder_dead_nodes_lock); 5522 5523 hlist_for_each_entry(ref, &node->refs, node_entry) { 5524 refs++; 5525 /* 5526 * Need the node lock to synchronize 5527 * with new notification requests and the 5528 * inner lock to synchronize with queued 5529 * death notifications. 5530 */ 5531 binder_inner_proc_lock(ref->proc); 5532 if (!ref->death) { 5533 binder_inner_proc_unlock(ref->proc); 5534 continue; 5535 } 5536 5537 death++; 5538 5539 BUG_ON(!list_empty(&ref->death->work.entry)); 5540 ref->death->work.type = BINDER_WORK_DEAD_BINDER; 5541 binder_enqueue_work_ilocked(&ref->death->work, 5542 &ref->proc->todo); 5543 binder_wakeup_proc_ilocked(ref->proc); 5544 binder_inner_proc_unlock(ref->proc); 5545 } 5546 5547 binder_debug(BINDER_DEBUG_DEAD_BINDER, 5548 "node %d now dead, refs %d, death %d\n", 5549 node->debug_id, refs, death); 5550 binder_node_unlock(node); 5551 binder_put_node(node); 5552 5553 return refs; 5554 } 5555 5556 static void binder_deferred_release(struct binder_proc *proc) 5557 { 5558 struct binder_context *context = proc->context; 5559 struct rb_node *n; 5560 int threads, nodes, incoming_refs, outgoing_refs, active_transactions; 5561 5562 mutex_lock(&binder_procs_lock); 5563 hlist_del(&proc->proc_node); 5564 mutex_unlock(&binder_procs_lock); 5565 5566 mutex_lock(&context->context_mgr_node_lock); 5567 if (context->binder_context_mgr_node && 5568 context->binder_context_mgr_node->proc == proc) { 5569 binder_debug(BINDER_DEBUG_DEAD_BINDER, 5570 "%s: %d context_mgr_node gone\n", 5571 __func__, proc->pid); 5572 context->binder_context_mgr_node = NULL; 5573 } 5574 mutex_unlock(&context->context_mgr_node_lock); 5575 binder_inner_proc_lock(proc); 5576 /* 5577 * Make sure proc stays alive after we 5578 * remove all the threads 5579 */ 5580 proc->tmp_ref++; 5581 5582 proc->is_dead = true; 5583 proc->is_frozen = false; 5584 proc->sync_recv = false; 5585 proc->async_recv = false; 5586 threads = 0; 5587 active_transactions = 0; 5588 while ((n = rb_first(&proc->threads))) { 5589 struct binder_thread *thread; 5590 5591 thread = rb_entry(n, struct binder_thread, rb_node); 5592 binder_inner_proc_unlock(proc); 5593 threads++; 5594 active_transactions += binder_thread_release(proc, thread); 5595 binder_inner_proc_lock(proc); 5596 } 5597 5598 nodes = 0; 5599 incoming_refs = 0; 5600 while ((n = rb_first(&proc->nodes))) { 5601 struct binder_node *node; 5602 5603 node = rb_entry(n, struct binder_node, rb_node); 5604 nodes++; 5605 /* 5606 * take a temporary ref on the node before 5607 * calling binder_node_release() which will either 5608 * kfree() the node or call binder_put_node() 5609 */ 5610 binder_inc_node_tmpref_ilocked(node); 5611 rb_erase(&node->rb_node, &proc->nodes); 5612 binder_inner_proc_unlock(proc); 5613 incoming_refs = binder_node_release(node, incoming_refs); 5614 binder_inner_proc_lock(proc); 5615 } 5616 binder_inner_proc_unlock(proc); 5617 5618 outgoing_refs = 0; 5619 binder_proc_lock(proc); 5620 while ((n = rb_first(&proc->refs_by_desc))) { 5621 struct binder_ref *ref; 5622 5623 ref = rb_entry(n, struct binder_ref, rb_node_desc); 5624 outgoing_refs++; 5625 binder_cleanup_ref_olocked(ref); 5626 binder_proc_unlock(proc); 5627 binder_free_ref(ref); 5628 binder_proc_lock(proc); 5629 } 5630 binder_proc_unlock(proc); 5631 5632 binder_release_work(proc, &proc->todo); 5633 binder_release_work(proc, &proc->delivered_death); 5634 5635 binder_debug(BINDER_DEBUG_OPEN_CLOSE, 5636 "%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n", 5637 __func__, proc->pid, threads, nodes, incoming_refs, 5638 outgoing_refs, active_transactions); 5639 5640 binder_proc_dec_tmpref(proc); 5641 } 5642 5643 static void binder_deferred_func(struct work_struct *work) 5644 { 5645 struct binder_proc *proc; 5646 5647 int defer; 5648 5649 do { 5650 mutex_lock(&binder_deferred_lock); 5651 if (!hlist_empty(&binder_deferred_list)) { 5652 proc = hlist_entry(binder_deferred_list.first, 5653 struct binder_proc, deferred_work_node); 5654 hlist_del_init(&proc->deferred_work_node); 5655 defer = proc->deferred_work; 5656 proc->deferred_work = 0; 5657 } else { 5658 proc = NULL; 5659 defer = 0; 5660 } 5661 mutex_unlock(&binder_deferred_lock); 5662 5663 if (defer & BINDER_DEFERRED_FLUSH) 5664 binder_deferred_flush(proc); 5665 5666 if (defer & BINDER_DEFERRED_RELEASE) 5667 binder_deferred_release(proc); /* frees proc */ 5668 } while (proc); 5669 } 5670 static DECLARE_WORK(binder_deferred_work, binder_deferred_func); 5671 5672 static void 5673 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer) 5674 { 5675 mutex_lock(&binder_deferred_lock); 5676 proc->deferred_work |= defer; 5677 if (hlist_unhashed(&proc->deferred_work_node)) { 5678 hlist_add_head(&proc->deferred_work_node, 5679 &binder_deferred_list); 5680 schedule_work(&binder_deferred_work); 5681 } 5682 mutex_unlock(&binder_deferred_lock); 5683 } 5684 5685 static void print_binder_transaction_ilocked(struct seq_file *m, 5686 struct binder_proc *proc, 5687 const char *prefix, 5688 struct binder_transaction *t) 5689 { 5690 struct binder_proc *to_proc; 5691 struct binder_buffer *buffer = t->buffer; 5692 5693 spin_lock(&t->lock); 5694 to_proc = t->to_proc; 5695 seq_printf(m, 5696 "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d", 5697 prefix, t->debug_id, t, 5698 t->from ? t->from->proc->pid : 0, 5699 t->from ? t->from->pid : 0, 5700 to_proc ? to_proc->pid : 0, 5701 t->to_thread ? t->to_thread->pid : 0, 5702 t->code, t->flags, t->priority, t->need_reply); 5703 spin_unlock(&t->lock); 5704 5705 if (proc != to_proc) { 5706 /* 5707 * Can only safely deref buffer if we are holding the 5708 * correct proc inner lock for this node 5709 */ 5710 seq_puts(m, "\n"); 5711 return; 5712 } 5713 5714 if (buffer == NULL) { 5715 seq_puts(m, " buffer free\n"); 5716 return; 5717 } 5718 if (buffer->target_node) 5719 seq_printf(m, " node %d", buffer->target_node->debug_id); 5720 seq_printf(m, " size %zd:%zd data %pK\n", 5721 buffer->data_size, buffer->offsets_size, 5722 buffer->user_data); 5723 } 5724 5725 static void print_binder_work_ilocked(struct seq_file *m, 5726 struct binder_proc *proc, 5727 const char *prefix, 5728 const char *transaction_prefix, 5729 struct binder_work *w) 5730 { 5731 struct binder_node *node; 5732 struct binder_transaction *t; 5733 5734 switch (w->type) { 5735 case BINDER_WORK_TRANSACTION: 5736 t = container_of(w, struct binder_transaction, work); 5737 print_binder_transaction_ilocked( 5738 m, proc, transaction_prefix, t); 5739 break; 5740 case BINDER_WORK_RETURN_ERROR: { 5741 struct binder_error *e = container_of( 5742 w, struct binder_error, work); 5743 5744 seq_printf(m, "%stransaction error: %u\n", 5745 prefix, e->cmd); 5746 } break; 5747 case BINDER_WORK_TRANSACTION_COMPLETE: 5748 seq_printf(m, "%stransaction complete\n", prefix); 5749 break; 5750 case BINDER_WORK_NODE: 5751 node = container_of(w, struct binder_node, work); 5752 seq_printf(m, "%snode work %d: u%016llx c%016llx\n", 5753 prefix, node->debug_id, 5754 (u64)node->ptr, (u64)node->cookie); 5755 break; 5756 case BINDER_WORK_DEAD_BINDER: 5757 seq_printf(m, "%shas dead binder\n", prefix); 5758 break; 5759 case BINDER_WORK_DEAD_BINDER_AND_CLEAR: 5760 seq_printf(m, "%shas cleared dead binder\n", prefix); 5761 break; 5762 case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: 5763 seq_printf(m, "%shas cleared death notification\n", prefix); 5764 break; 5765 default: 5766 seq_printf(m, "%sunknown work: type %d\n", prefix, w->type); 5767 break; 5768 } 5769 } 5770 5771 static void print_binder_thread_ilocked(struct seq_file *m, 5772 struct binder_thread *thread, 5773 int print_always) 5774 { 5775 struct binder_transaction *t; 5776 struct binder_work *w; 5777 size_t start_pos = m->count; 5778 size_t header_pos; 5779 5780 seq_printf(m, " thread %d: l %02x need_return %d tr %d\n", 5781 thread->pid, thread->looper, 5782 thread->looper_need_return, 5783 atomic_read(&thread->tmp_ref)); 5784 header_pos = m->count; 5785 t = thread->transaction_stack; 5786 while (t) { 5787 if (t->from == thread) { 5788 print_binder_transaction_ilocked(m, thread->proc, 5789 " outgoing transaction", t); 5790 t = t->from_parent; 5791 } else if (t->to_thread == thread) { 5792 print_binder_transaction_ilocked(m, thread->proc, 5793 " incoming transaction", t); 5794 t = t->to_parent; 5795 } else { 5796 print_binder_transaction_ilocked(m, thread->proc, 5797 " bad transaction", t); 5798 t = NULL; 5799 } 5800 } 5801 list_for_each_entry(w, &thread->todo, entry) { 5802 print_binder_work_ilocked(m, thread->proc, " ", 5803 " pending transaction", w); 5804 } 5805 if (!print_always && m->count == header_pos) 5806 m->count = start_pos; 5807 } 5808 5809 static void print_binder_node_nilocked(struct seq_file *m, 5810 struct binder_node *node) 5811 { 5812 struct binder_ref *ref; 5813 struct binder_work *w; 5814 int count; 5815 5816 count = 0; 5817 hlist_for_each_entry(ref, &node->refs, node_entry) 5818 count++; 5819 5820 seq_printf(m, " node %d: u%016llx c%016llx hs %d hw %d ls %d lw %d is %d iw %d tr %d", 5821 node->debug_id, (u64)node->ptr, (u64)node->cookie, 5822 node->has_strong_ref, node->has_weak_ref, 5823 node->local_strong_refs, node->local_weak_refs, 5824 node->internal_strong_refs, count, node->tmp_refs); 5825 if (count) { 5826 seq_puts(m, " proc"); 5827 hlist_for_each_entry(ref, &node->refs, node_entry) 5828 seq_printf(m, " %d", ref->proc->pid); 5829 } 5830 seq_puts(m, "\n"); 5831 if (node->proc) { 5832 list_for_each_entry(w, &node->async_todo, entry) 5833 print_binder_work_ilocked(m, node->proc, " ", 5834 " pending async transaction", w); 5835 } 5836 } 5837 5838 static void print_binder_ref_olocked(struct seq_file *m, 5839 struct binder_ref *ref) 5840 { 5841 binder_node_lock(ref->node); 5842 seq_printf(m, " ref %d: desc %d %snode %d s %d w %d d %pK\n", 5843 ref->data.debug_id, ref->data.desc, 5844 ref->node->proc ? "" : "dead ", 5845 ref->node->debug_id, ref->data.strong, 5846 ref->data.weak, ref->death); 5847 binder_node_unlock(ref->node); 5848 } 5849 5850 static void print_binder_proc(struct seq_file *m, 5851 struct binder_proc *proc, int print_all) 5852 { 5853 struct binder_work *w; 5854 struct rb_node *n; 5855 size_t start_pos = m->count; 5856 size_t header_pos; 5857 struct binder_node *last_node = NULL; 5858 5859 seq_printf(m, "proc %d\n", proc->pid); 5860 seq_printf(m, "context %s\n", proc->context->name); 5861 header_pos = m->count; 5862 5863 binder_inner_proc_lock(proc); 5864 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 5865 print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread, 5866 rb_node), print_all); 5867 5868 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) { 5869 struct binder_node *node = rb_entry(n, struct binder_node, 5870 rb_node); 5871 if (!print_all && !node->has_async_transaction) 5872 continue; 5873 5874 /* 5875 * take a temporary reference on the node so it 5876 * survives and isn't removed from the tree 5877 * while we print it. 5878 */ 5879 binder_inc_node_tmpref_ilocked(node); 5880 /* Need to drop inner lock to take node lock */ 5881 binder_inner_proc_unlock(proc); 5882 if (last_node) 5883 binder_put_node(last_node); 5884 binder_node_inner_lock(node); 5885 print_binder_node_nilocked(m, node); 5886 binder_node_inner_unlock(node); 5887 last_node = node; 5888 binder_inner_proc_lock(proc); 5889 } 5890 binder_inner_proc_unlock(proc); 5891 if (last_node) 5892 binder_put_node(last_node); 5893 5894 if (print_all) { 5895 binder_proc_lock(proc); 5896 for (n = rb_first(&proc->refs_by_desc); 5897 n != NULL; 5898 n = rb_next(n)) 5899 print_binder_ref_olocked(m, rb_entry(n, 5900 struct binder_ref, 5901 rb_node_desc)); 5902 binder_proc_unlock(proc); 5903 } 5904 binder_alloc_print_allocated(m, &proc->alloc); 5905 binder_inner_proc_lock(proc); 5906 list_for_each_entry(w, &proc->todo, entry) 5907 print_binder_work_ilocked(m, proc, " ", 5908 " pending transaction", w); 5909 list_for_each_entry(w, &proc->delivered_death, entry) { 5910 seq_puts(m, " has delivered dead binder\n"); 5911 break; 5912 } 5913 binder_inner_proc_unlock(proc); 5914 if (!print_all && m->count == header_pos) 5915 m->count = start_pos; 5916 } 5917 5918 static const char * const binder_return_strings[] = { 5919 "BR_ERROR", 5920 "BR_OK", 5921 "BR_TRANSACTION", 5922 "BR_REPLY", 5923 "BR_ACQUIRE_RESULT", 5924 "BR_DEAD_REPLY", 5925 "BR_TRANSACTION_COMPLETE", 5926 "BR_INCREFS", 5927 "BR_ACQUIRE", 5928 "BR_RELEASE", 5929 "BR_DECREFS", 5930 "BR_ATTEMPT_ACQUIRE", 5931 "BR_NOOP", 5932 "BR_SPAWN_LOOPER", 5933 "BR_FINISHED", 5934 "BR_DEAD_BINDER", 5935 "BR_CLEAR_DEATH_NOTIFICATION_DONE", 5936 "BR_FAILED_REPLY", 5937 "BR_FROZEN_REPLY", 5938 "BR_ONEWAY_SPAM_SUSPECT", 5939 }; 5940 5941 static const char * const binder_command_strings[] = { 5942 "BC_TRANSACTION", 5943 "BC_REPLY", 5944 "BC_ACQUIRE_RESULT", 5945 "BC_FREE_BUFFER", 5946 "BC_INCREFS", 5947 "BC_ACQUIRE", 5948 "BC_RELEASE", 5949 "BC_DECREFS", 5950 "BC_INCREFS_DONE", 5951 "BC_ACQUIRE_DONE", 5952 "BC_ATTEMPT_ACQUIRE", 5953 "BC_REGISTER_LOOPER", 5954 "BC_ENTER_LOOPER", 5955 "BC_EXIT_LOOPER", 5956 "BC_REQUEST_DEATH_NOTIFICATION", 5957 "BC_CLEAR_DEATH_NOTIFICATION", 5958 "BC_DEAD_BINDER_DONE", 5959 "BC_TRANSACTION_SG", 5960 "BC_REPLY_SG", 5961 }; 5962 5963 static const char * const binder_objstat_strings[] = { 5964 "proc", 5965 "thread", 5966 "node", 5967 "ref", 5968 "death", 5969 "transaction", 5970 "transaction_complete" 5971 }; 5972 5973 static void print_binder_stats(struct seq_file *m, const char *prefix, 5974 struct binder_stats *stats) 5975 { 5976 int i; 5977 5978 BUILD_BUG_ON(ARRAY_SIZE(stats->bc) != 5979 ARRAY_SIZE(binder_command_strings)); 5980 for (i = 0; i < ARRAY_SIZE(stats->bc); i++) { 5981 int temp = atomic_read(&stats->bc[i]); 5982 5983 if (temp) 5984 seq_printf(m, "%s%s: %d\n", prefix, 5985 binder_command_strings[i], temp); 5986 } 5987 5988 BUILD_BUG_ON(ARRAY_SIZE(stats->br) != 5989 ARRAY_SIZE(binder_return_strings)); 5990 for (i = 0; i < ARRAY_SIZE(stats->br); i++) { 5991 int temp = atomic_read(&stats->br[i]); 5992 5993 if (temp) 5994 seq_printf(m, "%s%s: %d\n", prefix, 5995 binder_return_strings[i], temp); 5996 } 5997 5998 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 5999 ARRAY_SIZE(binder_objstat_strings)); 6000 BUILD_BUG_ON(ARRAY_SIZE(stats->obj_created) != 6001 ARRAY_SIZE(stats->obj_deleted)); 6002 for (i = 0; i < ARRAY_SIZE(stats->obj_created); i++) { 6003 int created = atomic_read(&stats->obj_created[i]); 6004 int deleted = atomic_read(&stats->obj_deleted[i]); 6005 6006 if (created || deleted) 6007 seq_printf(m, "%s%s: active %d total %d\n", 6008 prefix, 6009 binder_objstat_strings[i], 6010 created - deleted, 6011 created); 6012 } 6013 } 6014 6015 static void print_binder_proc_stats(struct seq_file *m, 6016 struct binder_proc *proc) 6017 { 6018 struct binder_work *w; 6019 struct binder_thread *thread; 6020 struct rb_node *n; 6021 int count, strong, weak, ready_threads; 6022 size_t free_async_space = 6023 binder_alloc_get_free_async_space(&proc->alloc); 6024 6025 seq_printf(m, "proc %d\n", proc->pid); 6026 seq_printf(m, "context %s\n", proc->context->name); 6027 count = 0; 6028 ready_threads = 0; 6029 binder_inner_proc_lock(proc); 6030 for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) 6031 count++; 6032 6033 list_for_each_entry(thread, &proc->waiting_threads, waiting_thread_node) 6034 ready_threads++; 6035 6036 seq_printf(m, " threads: %d\n", count); 6037 seq_printf(m, " requested threads: %d+%d/%d\n" 6038 " ready threads %d\n" 6039 " free async space %zd\n", proc->requested_threads, 6040 proc->requested_threads_started, proc->max_threads, 6041 ready_threads, 6042 free_async_space); 6043 count = 0; 6044 for (n = rb_first(&proc->nodes); n != NULL; n = rb_next(n)) 6045 count++; 6046 binder_inner_proc_unlock(proc); 6047 seq_printf(m, " nodes: %d\n", count); 6048 count = 0; 6049 strong = 0; 6050 weak = 0; 6051 binder_proc_lock(proc); 6052 for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) { 6053 struct binder_ref *ref = rb_entry(n, struct binder_ref, 6054 rb_node_desc); 6055 count++; 6056 strong += ref->data.strong; 6057 weak += ref->data.weak; 6058 } 6059 binder_proc_unlock(proc); 6060 seq_printf(m, " refs: %d s %d w %d\n", count, strong, weak); 6061 6062 count = binder_alloc_get_allocated_count(&proc->alloc); 6063 seq_printf(m, " buffers: %d\n", count); 6064 6065 binder_alloc_print_pages(m, &proc->alloc); 6066 6067 count = 0; 6068 binder_inner_proc_lock(proc); 6069 list_for_each_entry(w, &proc->todo, entry) { 6070 if (w->type == BINDER_WORK_TRANSACTION) 6071 count++; 6072 } 6073 binder_inner_proc_unlock(proc); 6074 seq_printf(m, " pending transactions: %d\n", count); 6075 6076 print_binder_stats(m, " ", &proc->stats); 6077 } 6078 6079 6080 int binder_state_show(struct seq_file *m, void *unused) 6081 { 6082 struct binder_proc *proc; 6083 struct binder_node *node; 6084 struct binder_node *last_node = NULL; 6085 6086 seq_puts(m, "binder state:\n"); 6087 6088 spin_lock(&binder_dead_nodes_lock); 6089 if (!hlist_empty(&binder_dead_nodes)) 6090 seq_puts(m, "dead nodes:\n"); 6091 hlist_for_each_entry(node, &binder_dead_nodes, dead_node) { 6092 /* 6093 * take a temporary reference on the node so it 6094 * survives and isn't removed from the list 6095 * while we print it. 6096 */ 6097 node->tmp_refs++; 6098 spin_unlock(&binder_dead_nodes_lock); 6099 if (last_node) 6100 binder_put_node(last_node); 6101 binder_node_lock(node); 6102 print_binder_node_nilocked(m, node); 6103 binder_node_unlock(node); 6104 last_node = node; 6105 spin_lock(&binder_dead_nodes_lock); 6106 } 6107 spin_unlock(&binder_dead_nodes_lock); 6108 if (last_node) 6109 binder_put_node(last_node); 6110 6111 mutex_lock(&binder_procs_lock); 6112 hlist_for_each_entry(proc, &binder_procs, proc_node) 6113 print_binder_proc(m, proc, 1); 6114 mutex_unlock(&binder_procs_lock); 6115 6116 return 0; 6117 } 6118 6119 int binder_stats_show(struct seq_file *m, void *unused) 6120 { 6121 struct binder_proc *proc; 6122 6123 seq_puts(m, "binder stats:\n"); 6124 6125 print_binder_stats(m, "", &binder_stats); 6126 6127 mutex_lock(&binder_procs_lock); 6128 hlist_for_each_entry(proc, &binder_procs, proc_node) 6129 print_binder_proc_stats(m, proc); 6130 mutex_unlock(&binder_procs_lock); 6131 6132 return 0; 6133 } 6134 6135 int binder_transactions_show(struct seq_file *m, void *unused) 6136 { 6137 struct binder_proc *proc; 6138 6139 seq_puts(m, "binder transactions:\n"); 6140 mutex_lock(&binder_procs_lock); 6141 hlist_for_each_entry(proc, &binder_procs, proc_node) 6142 print_binder_proc(m, proc, 0); 6143 mutex_unlock(&binder_procs_lock); 6144 6145 return 0; 6146 } 6147 6148 static int proc_show(struct seq_file *m, void *unused) 6149 { 6150 struct binder_proc *itr; 6151 int pid = (unsigned long)m->private; 6152 6153 mutex_lock(&binder_procs_lock); 6154 hlist_for_each_entry(itr, &binder_procs, proc_node) { 6155 if (itr->pid == pid) { 6156 seq_puts(m, "binder proc state:\n"); 6157 print_binder_proc(m, itr, 1); 6158 } 6159 } 6160 mutex_unlock(&binder_procs_lock); 6161 6162 return 0; 6163 } 6164 6165 static void print_binder_transaction_log_entry(struct seq_file *m, 6166 struct binder_transaction_log_entry *e) 6167 { 6168 int debug_id = READ_ONCE(e->debug_id_done); 6169 /* 6170 * read barrier to guarantee debug_id_done read before 6171 * we print the log values 6172 */ 6173 smp_rmb(); 6174 seq_printf(m, 6175 "%d: %s from %d:%d to %d:%d context %s node %d handle %d size %d:%d ret %d/%d l=%d", 6176 e->debug_id, (e->call_type == 2) ? "reply" : 6177 ((e->call_type == 1) ? "async" : "call "), e->from_proc, 6178 e->from_thread, e->to_proc, e->to_thread, e->context_name, 6179 e->to_node, e->target_handle, e->data_size, e->offsets_size, 6180 e->return_error, e->return_error_param, 6181 e->return_error_line); 6182 /* 6183 * read-barrier to guarantee read of debug_id_done after 6184 * done printing the fields of the entry 6185 */ 6186 smp_rmb(); 6187 seq_printf(m, debug_id && debug_id == READ_ONCE(e->debug_id_done) ? 6188 "\n" : " (incomplete)\n"); 6189 } 6190 6191 int binder_transaction_log_show(struct seq_file *m, void *unused) 6192 { 6193 struct binder_transaction_log *log = m->private; 6194 unsigned int log_cur = atomic_read(&log->cur); 6195 unsigned int count; 6196 unsigned int cur; 6197 int i; 6198 6199 count = log_cur + 1; 6200 cur = count < ARRAY_SIZE(log->entry) && !log->full ? 6201 0 : count % ARRAY_SIZE(log->entry); 6202 if (count > ARRAY_SIZE(log->entry) || log->full) 6203 count = ARRAY_SIZE(log->entry); 6204 for (i = 0; i < count; i++) { 6205 unsigned int index = cur++ % ARRAY_SIZE(log->entry); 6206 6207 print_binder_transaction_log_entry(m, &log->entry[index]); 6208 } 6209 return 0; 6210 } 6211 6212 const struct file_operations binder_fops = { 6213 .owner = THIS_MODULE, 6214 .poll = binder_poll, 6215 .unlocked_ioctl = binder_ioctl, 6216 .compat_ioctl = compat_ptr_ioctl, 6217 .mmap = binder_mmap, 6218 .open = binder_open, 6219 .flush = binder_flush, 6220 .release = binder_release, 6221 }; 6222 6223 static int __init init_binder_device(const char *name) 6224 { 6225 int ret; 6226 struct binder_device *binder_device; 6227 6228 binder_device = kzalloc(sizeof(*binder_device), GFP_KERNEL); 6229 if (!binder_device) 6230 return -ENOMEM; 6231 6232 binder_device->miscdev.fops = &binder_fops; 6233 binder_device->miscdev.minor = MISC_DYNAMIC_MINOR; 6234 binder_device->miscdev.name = name; 6235 6236 refcount_set(&binder_device->ref, 1); 6237 binder_device->context.binder_context_mgr_uid = INVALID_UID; 6238 binder_device->context.name = name; 6239 mutex_init(&binder_device->context.context_mgr_node_lock); 6240 6241 ret = misc_register(&binder_device->miscdev); 6242 if (ret < 0) { 6243 kfree(binder_device); 6244 return ret; 6245 } 6246 6247 hlist_add_head(&binder_device->hlist, &binder_devices); 6248 6249 return ret; 6250 } 6251 6252 static int __init binder_init(void) 6253 { 6254 int ret; 6255 char *device_name, *device_tmp; 6256 struct binder_device *device; 6257 struct hlist_node *tmp; 6258 char *device_names = NULL; 6259 6260 ret = binder_alloc_shrinker_init(); 6261 if (ret) 6262 return ret; 6263 6264 atomic_set(&binder_transaction_log.cur, ~0U); 6265 atomic_set(&binder_transaction_log_failed.cur, ~0U); 6266 6267 binder_debugfs_dir_entry_root = debugfs_create_dir("binder", NULL); 6268 if (binder_debugfs_dir_entry_root) 6269 binder_debugfs_dir_entry_proc = debugfs_create_dir("proc", 6270 binder_debugfs_dir_entry_root); 6271 6272 if (binder_debugfs_dir_entry_root) { 6273 debugfs_create_file("state", 6274 0444, 6275 binder_debugfs_dir_entry_root, 6276 NULL, 6277 &binder_state_fops); 6278 debugfs_create_file("stats", 6279 0444, 6280 binder_debugfs_dir_entry_root, 6281 NULL, 6282 &binder_stats_fops); 6283 debugfs_create_file("transactions", 6284 0444, 6285 binder_debugfs_dir_entry_root, 6286 NULL, 6287 &binder_transactions_fops); 6288 debugfs_create_file("transaction_log", 6289 0444, 6290 binder_debugfs_dir_entry_root, 6291 &binder_transaction_log, 6292 &binder_transaction_log_fops); 6293 debugfs_create_file("failed_transaction_log", 6294 0444, 6295 binder_debugfs_dir_entry_root, 6296 &binder_transaction_log_failed, 6297 &binder_transaction_log_fops); 6298 } 6299 6300 if (!IS_ENABLED(CONFIG_ANDROID_BINDERFS) && 6301 strcmp(binder_devices_param, "") != 0) { 6302 /* 6303 * Copy the module_parameter string, because we don't want to 6304 * tokenize it in-place. 6305 */ 6306 device_names = kstrdup(binder_devices_param, GFP_KERNEL); 6307 if (!device_names) { 6308 ret = -ENOMEM; 6309 goto err_alloc_device_names_failed; 6310 } 6311 6312 device_tmp = device_names; 6313 while ((device_name = strsep(&device_tmp, ","))) { 6314 ret = init_binder_device(device_name); 6315 if (ret) 6316 goto err_init_binder_device_failed; 6317 } 6318 } 6319 6320 ret = init_binderfs(); 6321 if (ret) 6322 goto err_init_binder_device_failed; 6323 6324 return ret; 6325 6326 err_init_binder_device_failed: 6327 hlist_for_each_entry_safe(device, tmp, &binder_devices, hlist) { 6328 misc_deregister(&device->miscdev); 6329 hlist_del(&device->hlist); 6330 kfree(device); 6331 } 6332 6333 kfree(device_names); 6334 6335 err_alloc_device_names_failed: 6336 debugfs_remove_recursive(binder_debugfs_dir_entry_root); 6337 6338 return ret; 6339 } 6340 6341 device_initcall(binder_init); 6342 6343 #define CREATE_TRACE_POINTS 6344 #include "binder_trace.h" 6345 6346 MODULE_LICENSE("GPL v2"); 6347