Merge tag 'char-misc-4.15-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel...
[sfrench/cifs-2.6.git] / drivers / android / binder.c
1 /* binder.c
2  *
3  * Android IPC Subsystem
4  *
5  * Copyright (C) 2007-2008 Google, Inc.
6  *
7  * This software is licensed under the terms of the GNU General Public
8  * License version 2, as published by the Free Software Foundation, and
9  * may be copied, distributed, and modified under those terms.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  */
17
18 /*
19  * Locking overview
20  *
21  * There are 3 main spinlocks which must be acquired in the
22  * order shown:
23  *
24  * 1) proc->outer_lock : protects binder_ref
25  *    binder_proc_lock() and binder_proc_unlock() are
26  *    used to acq/rel.
27  * 2) node->lock : protects most fields of binder_node.
28  *    binder_node_lock() and binder_node_unlock() are
29  *    used to acq/rel
30  * 3) proc->inner_lock : protects the thread and node lists
31  *    (proc->threads, proc->waiting_threads, proc->nodes)
32  *    and all todo lists associated with the binder_proc
33  *    (proc->todo, thread->todo, proc->delivered_death and
34  *    node->async_todo), as well as thread->transaction_stack
35  *    binder_inner_proc_lock() and binder_inner_proc_unlock()
36  *    are used to acq/rel
37  *
38  * Any lock under procA must never be nested under any lock at the same
39  * level or below on procB.
40  *
41  * Functions that require a lock held on entry indicate which lock
42  * in the suffix of the function name:
43  *
44  * foo_olocked() : requires node->outer_lock
45  * foo_nlocked() : requires node->lock
46  * foo_ilocked() : requires proc->inner_lock
47  * foo_oilocked(): requires proc->outer_lock and proc->inner_lock
48  * foo_nilocked(): requires node->lock and proc->inner_lock
49  * ...
50  */
51
52 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
53
54 #include <asm/cacheflush.h>
55 #include <linux/fdtable.h>
56 #include <linux/file.h>
57 #include <linux/freezer.h>
58 #include <linux/fs.h>
59 #include <linux/list.h>
60 #include <linux/miscdevice.h>
61 #include <linux/module.h>
62 #include <linux/mutex.h>
63 #include <linux/nsproxy.h>
64 #include <linux/poll.h>
65 #include <linux/debugfs.h>
66 #include <linux/rbtree.h>
67 #include <linux/sched/signal.h>
68 #include <linux/sched/mm.h>
69 #include <linux/seq_file.h>
70 #include <linux/uaccess.h>
71 #include <linux/pid_namespace.h>
72 #include <linux/security.h>
73 #include <linux/spinlock.h>
74
75 #ifdef CONFIG_ANDROID_BINDER_IPC_32BIT
76 #define BINDER_IPC_32BIT 1
77 #endif
78
79 #include <uapi/linux/android/binder.h>
80 #include "binder_alloc.h"
81 #include "binder_trace.h"
82
83 static HLIST_HEAD(binder_deferred_list);
84 static DEFINE_MUTEX(binder_deferred_lock);
85
86 static HLIST_HEAD(binder_devices);
87 static HLIST_HEAD(binder_procs);
88 static DEFINE_MUTEX(binder_procs_lock);
89
90 static HLIST_HEAD(binder_dead_nodes);
91 static DEFINE_SPINLOCK(binder_dead_nodes_lock);
92
93 static struct dentry *binder_debugfs_dir_entry_root;
94 static struct dentry *binder_debugfs_dir_entry_proc;
95 static atomic_t binder_last_id;
96
97 #define BINDER_DEBUG_ENTRY(name) \
98 static int binder_##name##_open(struct inode *inode, struct file *file) \
99 { \
100         return single_open(file, binder_##name##_show, inode->i_private); \
101 } \
102 \
103 static const struct file_operations binder_##name##_fops = { \
104         .owner = THIS_MODULE, \
105         .open = binder_##name##_open, \
106         .read = seq_read, \
107         .llseek = seq_lseek, \
108         .release = single_release, \
109 }
110
111 static int binder_proc_show(struct seq_file *m, void *unused);
112 BINDER_DEBUG_ENTRY(proc);
113
114 /* This is only defined in include/asm-arm/sizes.h */
115 #ifndef SZ_1K
116 #define SZ_1K                               0x400
117 #endif
118
119 #ifndef SZ_4M
120 #define SZ_4M                               0x400000
121 #endif
122
123 #define FORBIDDEN_MMAP_FLAGS                (VM_WRITE)
124
125 enum {
126         BINDER_DEBUG_USER_ERROR             = 1U << 0,
127         BINDER_DEBUG_FAILED_TRANSACTION     = 1U << 1,
128         BINDER_DEBUG_DEAD_TRANSACTION       = 1U << 2,
129         BINDER_DEBUG_OPEN_CLOSE             = 1U << 3,
130         BINDER_DEBUG_DEAD_BINDER            = 1U << 4,
131         BINDER_DEBUG_DEATH_NOTIFICATION     = 1U << 5,
132         BINDER_DEBUG_READ_WRITE             = 1U << 6,
133         BINDER_DEBUG_USER_REFS              = 1U << 7,
134         BINDER_DEBUG_THREADS                = 1U << 8,
135         BINDER_DEBUG_TRANSACTION            = 1U << 9,
136         BINDER_DEBUG_TRANSACTION_COMPLETE   = 1U << 10,
137         BINDER_DEBUG_FREE_BUFFER            = 1U << 11,
138         BINDER_DEBUG_INTERNAL_REFS          = 1U << 12,
139         BINDER_DEBUG_PRIORITY_CAP           = 1U << 13,
140         BINDER_DEBUG_SPINLOCKS              = 1U << 14,
141 };
142 static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |
143         BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;
144 module_param_named(debug_mask, binder_debug_mask, uint, S_IWUSR | S_IRUGO);
145
146 static char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
147 module_param_named(devices, binder_devices_param, charp, 0444);
148
149 static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);
150 static int binder_stop_on_user_error;
151
152 static int binder_set_stop_on_user_error(const char *val,
153                                          const struct kernel_param *kp)
154 {
155         int ret;
156
157         ret = param_set_int(val, kp);
158         if (binder_stop_on_user_error < 2)
159                 wake_up(&binder_user_error_wait);
160         return ret;
161 }
162 module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
163         param_get_int, &binder_stop_on_user_error, S_IWUSR | S_IRUGO);
164
165 #define binder_debug(mask, x...) \
166         do { \
167                 if (binder_debug_mask & mask) \
168                         pr_info(x); \
169         } while (0)
170
171 #define binder_user_error(x...) \
172         do { \
173                 if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) \
174                         pr_info(x); \
175                 if (binder_stop_on_user_error) \
176                         binder_stop_on_user_error = 2; \
177         } while (0)
178
179 #define to_flat_binder_object(hdr) \
180         container_of(hdr, struct flat_binder_object, hdr)
181
182 #define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)
183
184 #define to_binder_buffer_object(hdr) \
185         container_of(hdr, struct binder_buffer_object, hdr)
186
187 #define to_binder_fd_array_object(hdr) \
188         container_of(hdr, struct binder_fd_array_object, hdr)
189
190 enum binder_stat_types {
191         BINDER_STAT_PROC,
192         BINDER_STAT_THREAD,
193         BINDER_STAT_NODE,
194         BINDER_STAT_REF,
195         BINDER_STAT_DEATH,
196         BINDER_STAT_TRANSACTION,
197         BINDER_STAT_TRANSACTION_COMPLETE,
198         BINDER_STAT_COUNT
199 };
200
201 struct binder_stats {
202         atomic_t br[_IOC_NR(BR_FAILED_REPLY) + 1];
203         atomic_t bc[_IOC_NR(BC_REPLY_SG) + 1];
204         atomic_t obj_created[BINDER_STAT_COUNT];
205         atomic_t obj_deleted[BINDER_STAT_COUNT];
206 };
207
208 static struct binder_stats binder_stats;
209
210 static inline void binder_stats_deleted(enum binder_stat_types type)
211 {
212         atomic_inc(&binder_stats.obj_deleted[type]);
213 }
214
215 static inline void binder_stats_created(enum binder_stat_types type)
216 {
217         atomic_inc(&binder_stats.obj_created[type]);
218 }
219
220 struct binder_transaction_log_entry {
221         int debug_id;
222         int debug_id_done;
223         int call_type;
224         int from_proc;
225         int from_thread;
226         int target_handle;
227         int to_proc;
228         int to_thread;
229         int to_node;
230         int data_size;
231         int offsets_size;
232         int return_error_line;
233         uint32_t return_error;
234         uint32_t return_error_param;
235         const char *context_name;
236 };
237 struct binder_transaction_log {
238         atomic_t cur;
239         bool full;
240         struct binder_transaction_log_entry entry[32];
241 };
242 static struct binder_transaction_log binder_transaction_log;
243 static struct binder_transaction_log binder_transaction_log_failed;
244
245 static struct binder_transaction_log_entry *binder_transaction_log_add(
246         struct binder_transaction_log *log)
247 {
248         struct binder_transaction_log_entry *e;
249         unsigned int cur = atomic_inc_return(&log->cur);
250
251         if (cur >= ARRAY_SIZE(log->entry))
252                 log->full = 1;
253         e = &log->entry[cur % ARRAY_SIZE(log->entry)];
254         WRITE_ONCE(e->debug_id_done, 0);
255         /*
256          * write-barrier to synchronize access to e->debug_id_done.
257          * We make sure the initialized 0 value is seen before
258          * memset() other fields are zeroed by memset.
259          */
260         smp_wmb();
261         memset(e, 0, sizeof(*e));
262         return e;
263 }
264
265 struct binder_context {
266         struct binder_node *binder_context_mgr_node;
267         struct mutex context_mgr_node_lock;
268
269         kuid_t binder_context_mgr_uid;
270         const char *name;
271 };
272
273 struct binder_device {
274         struct hlist_node hlist;
275         struct miscdevice miscdev;
276         struct binder_context context;
277 };
278
279 /**
280  * struct binder_work - work enqueued on a worklist
281  * @entry:             node enqueued on list
282  * @type:              type of work to be performed
283  *
284  * There are separate work lists for proc, thread, and node (async).
285  */
286 struct binder_work {
287         struct list_head entry;
288
289         enum {
290                 BINDER_WORK_TRANSACTION = 1,
291                 BINDER_WORK_TRANSACTION_COMPLETE,
292                 BINDER_WORK_RETURN_ERROR,
293                 BINDER_WORK_NODE,
294                 BINDER_WORK_DEAD_BINDER,
295                 BINDER_WORK_DEAD_BINDER_AND_CLEAR,
296                 BINDER_WORK_CLEAR_DEATH_NOTIFICATION,
297         } type;
298 };
299
300 struct binder_error {
301         struct binder_work work;
302         uint32_t cmd;
303 };
304
305 /**
306  * struct binder_node - binder node bookkeeping
307  * @debug_id:             unique ID for debugging
308  *                        (invariant after initialized)
309  * @lock:                 lock for node fields
310  * @work:                 worklist element for node work
311  *                        (protected by @proc->inner_lock)
312  * @rb_node:              element for proc->nodes tree
313  *                        (protected by @proc->inner_lock)
314  * @dead_node:            element for binder_dead_nodes list
315  *                        (protected by binder_dead_nodes_lock)
316  * @proc:                 binder_proc that owns this node
317  *                        (invariant after initialized)
318  * @refs:                 list of references on this node
319  *                        (protected by @lock)
320  * @internal_strong_refs: used to take strong references when
321  *                        initiating a transaction
322  *                        (protected by @proc->inner_lock if @proc
323  *                        and by @lock)
324  * @local_weak_refs:      weak user refs from local process
325  *                        (protected by @proc->inner_lock if @proc
326  *                        and by @lock)
327  * @local_strong_refs:    strong user refs from local process
328  *                        (protected by @proc->inner_lock if @proc
329  *                        and by @lock)
330  * @tmp_refs:             temporary kernel refs
331  *                        (protected by @proc->inner_lock while @proc
332  *                        is valid, and by binder_dead_nodes_lock
333  *                        if @proc is NULL. During inc/dec and node release
334  *                        it is also protected by @lock to provide safety
335  *                        as the node dies and @proc becomes NULL)
336  * @ptr:                  userspace pointer for node
337  *                        (invariant, no lock needed)
338  * @cookie:               userspace cookie for node
339  *                        (invariant, no lock needed)
340  * @has_strong_ref:       userspace notified of strong ref
341  *                        (protected by @proc->inner_lock if @proc
342  *                        and by @lock)
343  * @pending_strong_ref:   userspace has acked notification of strong ref
344  *                        (protected by @proc->inner_lock if @proc
345  *                        and by @lock)
346  * @has_weak_ref:         userspace notified of weak ref
347  *                        (protected by @proc->inner_lock if @proc
348  *                        and by @lock)
349  * @pending_weak_ref:     userspace has acked notification of weak ref
350  *                        (protected by @proc->inner_lock if @proc
351  *                        and by @lock)
352  * @has_async_transaction: async transaction to node in progress
353  *                        (protected by @lock)
354  * @accept_fds:           file descriptor operations supported for node
355  *                        (invariant after initialized)
356  * @min_priority:         minimum scheduling priority
357  *                        (invariant after initialized)
358  * @async_todo:           list of async work items
359  *                        (protected by @proc->inner_lock)
360  *
361  * Bookkeeping structure for binder nodes.
362  */
363 struct binder_node {
364         int debug_id;
365         spinlock_t lock;
366         struct binder_work work;
367         union {
368                 struct rb_node rb_node;
369                 struct hlist_node dead_node;
370         };
371         struct binder_proc *proc;
372         struct hlist_head refs;
373         int internal_strong_refs;
374         int local_weak_refs;
375         int local_strong_refs;
376         int tmp_refs;
377         binder_uintptr_t ptr;
378         binder_uintptr_t cookie;
379         struct {
380                 /*
381                  * bitfield elements protected by
382                  * proc inner_lock
383                  */
384                 u8 has_strong_ref:1;
385                 u8 pending_strong_ref:1;
386                 u8 has_weak_ref:1;
387                 u8 pending_weak_ref:1;
388         };
389         struct {
390                 /*
391                  * invariant after initialization
392                  */
393                 u8 accept_fds:1;
394                 u8 min_priority;
395         };
396         bool has_async_transaction;
397         struct list_head async_todo;
398 };
399
400 struct binder_ref_death {
401         /**
402          * @work: worklist element for death notifications
403          *        (protected by inner_lock of the proc that
404          *        this ref belongs to)
405          */
406         struct binder_work work;
407         binder_uintptr_t cookie;
408 };
409
410 /**
411  * struct binder_ref_data - binder_ref counts and id
412  * @debug_id:        unique ID for the ref
413  * @desc:            unique userspace handle for ref
414  * @strong:          strong ref count (debugging only if not locked)
415  * @weak:            weak ref count (debugging only if not locked)
416  *
417  * Structure to hold ref count and ref id information. Since
418  * the actual ref can only be accessed with a lock, this structure
419  * is used to return information about the ref to callers of
420  * ref inc/dec functions.
421  */
422 struct binder_ref_data {
423         int debug_id;
424         uint32_t desc;
425         int strong;
426         int weak;
427 };
428
429 /**
430  * struct binder_ref - struct to track references on nodes
431  * @data:        binder_ref_data containing id, handle, and current refcounts
432  * @rb_node_desc: node for lookup by @data.desc in proc's rb_tree
433  * @rb_node_node: node for lookup by @node in proc's rb_tree
434  * @node_entry:  list entry for node->refs list in target node
435  *               (protected by @node->lock)
436  * @proc:        binder_proc containing ref
437  * @node:        binder_node of target node. When cleaning up a
438  *               ref for deletion in binder_cleanup_ref, a non-NULL
439  *               @node indicates the node must be freed
440  * @death:       pointer to death notification (ref_death) if requested
441  *               (protected by @node->lock)
442  *
443  * Structure to track references from procA to target node (on procB). This
444  * structure is unsafe to access without holding @proc->outer_lock.
445  */
446 struct binder_ref {
447         /* Lookups needed: */
448         /*   node + proc => ref (transaction) */
449         /*   desc + proc => ref (transaction, inc/dec ref) */
450         /*   node => refs + procs (proc exit) */
451         struct binder_ref_data data;
452         struct rb_node rb_node_desc;
453         struct rb_node rb_node_node;
454         struct hlist_node node_entry;
455         struct binder_proc *proc;
456         struct binder_node *node;
457         struct binder_ref_death *death;
458 };
459
460 enum binder_deferred_state {
461         BINDER_DEFERRED_PUT_FILES    = 0x01,
462         BINDER_DEFERRED_FLUSH        = 0x02,
463         BINDER_DEFERRED_RELEASE      = 0x04,
464 };
465
466 /**
467  * struct binder_proc - binder process bookkeeping
468  * @proc_node:            element for binder_procs list
469  * @threads:              rbtree of binder_threads in this proc
470  *                        (protected by @inner_lock)
471  * @nodes:                rbtree of binder nodes associated with
472  *                        this proc ordered by node->ptr
473  *                        (protected by @inner_lock)
474  * @refs_by_desc:         rbtree of refs ordered by ref->desc
475  *                        (protected by @outer_lock)
476  * @refs_by_node:         rbtree of refs ordered by ref->node
477  *                        (protected by @outer_lock)
478  * @waiting_threads:      threads currently waiting for proc work
479  *                        (protected by @inner_lock)
480  * @pid                   PID of group_leader of process
481  *                        (invariant after initialized)
482  * @tsk                   task_struct for group_leader of process
483  *                        (invariant after initialized)
484  * @files                 files_struct for process
485  *                        (invariant after initialized)
486  * @deferred_work_node:   element for binder_deferred_list
487  *                        (protected by binder_deferred_lock)
488  * @deferred_work:        bitmap of deferred work to perform
489  *                        (protected by binder_deferred_lock)
490  * @is_dead:              process is dead and awaiting free
491  *                        when outstanding transactions are cleaned up
492  *                        (protected by @inner_lock)
493  * @todo:                 list of work for this process
494  *                        (protected by @inner_lock)
495  * @wait:                 wait queue head to wait for proc work
496  *                        (invariant after initialized)
497  * @stats:                per-process binder statistics
498  *                        (atomics, no lock needed)
499  * @delivered_death:      list of delivered death notification
500  *                        (protected by @inner_lock)
501  * @max_threads:          cap on number of binder threads
502  *                        (protected by @inner_lock)
503  * @requested_threads:    number of binder threads requested but not
504  *                        yet started. In current implementation, can
505  *                        only be 0 or 1.
506  *                        (protected by @inner_lock)
507  * @requested_threads_started: number binder threads started
508  *                        (protected by @inner_lock)
509  * @tmp_ref:              temporary reference to indicate proc is in use
510  *                        (protected by @inner_lock)
511  * @default_priority:     default scheduler priority
512  *                        (invariant after initialized)
513  * @debugfs_entry:        debugfs node
514  * @alloc:                binder allocator bookkeeping
515  * @context:              binder_context for this proc
516  *                        (invariant after initialized)
517  * @inner_lock:           can nest under outer_lock and/or node lock
518  * @outer_lock:           no nesting under innor or node lock
519  *                        Lock order: 1) outer, 2) node, 3) inner
520  *
521  * Bookkeeping structure for binder processes
522  */
523 struct binder_proc {
524         struct hlist_node proc_node;
525         struct rb_root threads;
526         struct rb_root nodes;
527         struct rb_root refs_by_desc;
528         struct rb_root refs_by_node;
529         struct list_head waiting_threads;
530         int pid;
531         struct task_struct *tsk;
532         struct files_struct *files;
533         struct hlist_node deferred_work_node;
534         int deferred_work;
535         bool is_dead;
536
537         struct list_head todo;
538         wait_queue_head_t wait;
539         struct binder_stats stats;
540         struct list_head delivered_death;
541         int max_threads;
542         int requested_threads;
543         int requested_threads_started;
544         int tmp_ref;
545         long default_priority;
546         struct dentry *debugfs_entry;
547         struct binder_alloc alloc;
548         struct binder_context *context;
549         spinlock_t inner_lock;
550         spinlock_t outer_lock;
551 };
552
553 enum {
554         BINDER_LOOPER_STATE_REGISTERED  = 0x01,
555         BINDER_LOOPER_STATE_ENTERED     = 0x02,
556         BINDER_LOOPER_STATE_EXITED      = 0x04,
557         BINDER_LOOPER_STATE_INVALID     = 0x08,
558         BINDER_LOOPER_STATE_WAITING     = 0x10,
559         BINDER_LOOPER_STATE_POLL        = 0x20,
560 };
561
562 /**
563  * struct binder_thread - binder thread bookkeeping
564  * @proc:                 binder process for this thread
565  *                        (invariant after initialization)
566  * @rb_node:              element for proc->threads rbtree
567  *                        (protected by @proc->inner_lock)
568  * @waiting_thread_node:  element for @proc->waiting_threads list
569  *                        (protected by @proc->inner_lock)
570  * @pid:                  PID for this thread
571  *                        (invariant after initialization)
572  * @looper:               bitmap of looping state
573  *                        (only accessed by this thread)
574  * @looper_needs_return:  looping thread needs to exit driver
575  *                        (no lock needed)
576  * @transaction_stack:    stack of in-progress transactions for this thread
577  *                        (protected by @proc->inner_lock)
578  * @todo:                 list of work to do for this thread
579  *                        (protected by @proc->inner_lock)
580  * @return_error:         transaction errors reported by this thread
581  *                        (only accessed by this thread)
582  * @reply_error:          transaction errors reported by target thread
583  *                        (protected by @proc->inner_lock)
584  * @wait:                 wait queue for thread work
585  * @stats:                per-thread statistics
586  *                        (atomics, no lock needed)
587  * @tmp_ref:              temporary reference to indicate thread is in use
588  *                        (atomic since @proc->inner_lock cannot
589  *                        always be acquired)
590  * @is_dead:              thread is dead and awaiting free
591  *                        when outstanding transactions are cleaned up
592  *                        (protected by @proc->inner_lock)
593  *
594  * Bookkeeping structure for binder threads.
595  */
596 struct binder_thread {
597         struct binder_proc *proc;
598         struct rb_node rb_node;
599         struct list_head waiting_thread_node;
600         int pid;
601         int looper;              /* only modified by this thread */
602         bool looper_need_return; /* can be written by other thread */
603         struct binder_transaction *transaction_stack;
604         struct list_head todo;
605         struct binder_error return_error;
606         struct binder_error reply_error;
607         wait_queue_head_t wait;
608         struct binder_stats stats;
609         atomic_t tmp_ref;
610         bool is_dead;
611 };
612
613 struct binder_transaction {
614         int debug_id;
615         struct binder_work work;
616         struct binder_thread *from;
617         struct binder_transaction *from_parent;
618         struct binder_proc *to_proc;
619         struct binder_thread *to_thread;
620         struct binder_transaction *to_parent;
621         unsigned need_reply:1;
622         /* unsigned is_dead:1; */       /* not used at the moment */
623
624         struct binder_buffer *buffer;
625         unsigned int    code;
626         unsigned int    flags;
627         long    priority;
628         long    saved_priority;
629         kuid_t  sender_euid;
630         /**
631          * @lock:  protects @from, @to_proc, and @to_thread
632          *
633          * @from, @to_proc, and @to_thread can be set to NULL
634          * during thread teardown
635          */
636         spinlock_t lock;
637 };
638
639 /**
640  * binder_proc_lock() - Acquire outer lock for given binder_proc
641  * @proc:         struct binder_proc to acquire
642  *
643  * Acquires proc->outer_lock. Used to protect binder_ref
644  * structures associated with the given proc.
645  */
646 #define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)
647 static void
648 _binder_proc_lock(struct binder_proc *proc, int line)
649 {
650         binder_debug(BINDER_DEBUG_SPINLOCKS,
651                      "%s: line=%d\n", __func__, line);
652         spin_lock(&proc->outer_lock);
653 }
654
655 /**
656  * binder_proc_unlock() - Release spinlock for given binder_proc
657  * @proc:         struct binder_proc to acquire
658  *
659  * Release lock acquired via binder_proc_lock()
660  */
661 #define binder_proc_unlock(_proc) _binder_proc_unlock(_proc, __LINE__)
662 static void
663 _binder_proc_unlock(struct binder_proc *proc, int line)
664 {
665         binder_debug(BINDER_DEBUG_SPINLOCKS,
666                      "%s: line=%d\n", __func__, line);
667         spin_unlock(&proc->outer_lock);
668 }
669
670 /**
671  * binder_inner_proc_lock() - Acquire inner lock for given binder_proc
672  * @proc:         struct binder_proc to acquire
673  *
674  * Acquires proc->inner_lock. Used to protect todo lists
675  */
676 #define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)
677 static void
678 _binder_inner_proc_lock(struct binder_proc *proc, int line)
679 {
680         binder_debug(BINDER_DEBUG_SPINLOCKS,
681                      "%s: line=%d\n", __func__, line);
682         spin_lock(&proc->inner_lock);
683 }
684
685 /**
686  * binder_inner_proc_unlock() - Release inner lock for given binder_proc
687  * @proc:         struct binder_proc to acquire
688  *
689  * Release lock acquired via binder_inner_proc_lock()
690  */
691 #define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)
692 static void
693 _binder_inner_proc_unlock(struct binder_proc *proc, int line)
694 {
695         binder_debug(BINDER_DEBUG_SPINLOCKS,
696                      "%s: line=%d\n", __func__, line);
697         spin_unlock(&proc->inner_lock);
698 }
699
700 /**
701  * binder_node_lock() - Acquire spinlock for given binder_node
702  * @node:         struct binder_node to acquire
703  *
704  * Acquires node->lock. Used to protect binder_node fields
705  */
706 #define binder_node_lock(node) _binder_node_lock(node, __LINE__)
707 static void
708 _binder_node_lock(struct binder_node *node, int line)
709 {
710         binder_debug(BINDER_DEBUG_SPINLOCKS,
711                      "%s: line=%d\n", __func__, line);
712         spin_lock(&node->lock);
713 }
714
715 /**
716  * binder_node_unlock() - Release spinlock for given binder_proc
717  * @node:         struct binder_node to acquire
718  *
719  * Release lock acquired via binder_node_lock()
720  */
721 #define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)
722 static void
723 _binder_node_unlock(struct binder_node *node, int line)
724 {
725         binder_debug(BINDER_DEBUG_SPINLOCKS,
726                      "%s: line=%d\n", __func__, line);
727         spin_unlock(&node->lock);
728 }
729
730 /**
731  * binder_node_inner_lock() - Acquire node and inner locks
732  * @node:         struct binder_node to acquire
733  *
734  * Acquires node->lock. If node->proc also acquires
735  * proc->inner_lock. Used to protect binder_node fields
736  */
737 #define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)
738 static void
739 _binder_node_inner_lock(struct binder_node *node, int line)
740 {
741         binder_debug(BINDER_DEBUG_SPINLOCKS,
742                      "%s: line=%d\n", __func__, line);
743         spin_lock(&node->lock);
744         if (node->proc)
745                 binder_inner_proc_lock(node->proc);
746 }
747
748 /**
749  * binder_node_unlock() - Release node and inner locks
750  * @node:         struct binder_node to acquire
751  *
752  * Release lock acquired via binder_node_lock()
753  */
754 #define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)
755 static void
756 _binder_node_inner_unlock(struct binder_node *node, int line)
757 {
758         struct binder_proc *proc = node->proc;
759
760         binder_debug(BINDER_DEBUG_SPINLOCKS,
761                      "%s: line=%d\n", __func__, line);
762         if (proc)
763                 binder_inner_proc_unlock(proc);
764         spin_unlock(&node->lock);
765 }
766
767 static bool binder_worklist_empty_ilocked(struct list_head *list)
768 {
769         return list_empty(list);
770 }
771
772 /**
773  * binder_worklist_empty() - Check if no items on the work list
774  * @proc:       binder_proc associated with list
775  * @list:       list to check
776  *
777  * Return: true if there are no items on list, else false
778  */
779 static bool binder_worklist_empty(struct binder_proc *proc,
780                                   struct list_head *list)
781 {
782         bool ret;
783
784         binder_inner_proc_lock(proc);
785         ret = binder_worklist_empty_ilocked(list);
786         binder_inner_proc_unlock(proc);
787         return ret;
788 }
789
790 static void
791 binder_enqueue_work_ilocked(struct binder_work *work,
792                            struct list_head *target_list)
793 {
794         BUG_ON(target_list == NULL);
795         BUG_ON(work->entry.next && !list_empty(&work->entry));
796         list_add_tail(&work->entry, target_list);
797 }
798
799 /**
800  * binder_enqueue_work() - Add an item to the work list
801  * @proc:         binder_proc associated with list
802  * @work:         struct binder_work to add to list
803  * @target_list:  list to add work to
804  *
805  * Adds the work to the specified list. Asserts that work
806  * is not already on a list.
807  */
808 static void
809 binder_enqueue_work(struct binder_proc *proc,
810                     struct binder_work *work,
811                     struct list_head *target_list)
812 {
813         binder_inner_proc_lock(proc);
814         binder_enqueue_work_ilocked(work, target_list);
815         binder_inner_proc_unlock(proc);
816 }
817
818 static void
819 binder_dequeue_work_ilocked(struct binder_work *work)
820 {
821         list_del_init(&work->entry);
822 }
823
824 /**
825  * binder_dequeue_work() - Removes an item from the work list
826  * @proc:         binder_proc associated with list
827  * @work:         struct binder_work to remove from list
828  *
829  * Removes the specified work item from whatever list it is on.
830  * Can safely be called if work is not on any list.
831  */
832 static void
833 binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)
834 {
835         binder_inner_proc_lock(proc);
836         binder_dequeue_work_ilocked(work);
837         binder_inner_proc_unlock(proc);
838 }
839
840 static struct binder_work *binder_dequeue_work_head_ilocked(
841                                         struct list_head *list)
842 {
843         struct binder_work *w;
844
845         w = list_first_entry_or_null(list, struct binder_work, entry);
846         if (w)
847                 list_del_init(&w->entry);
848         return w;
849 }
850
851 /**
852  * binder_dequeue_work_head() - Dequeues the item at head of list
853  * @proc:         binder_proc associated with list
854  * @list:         list to dequeue head
855  *
856  * Removes the head of the list if there are items on the list
857  *
858  * Return: pointer dequeued binder_work, NULL if list was empty
859  */
860 static struct binder_work *binder_dequeue_work_head(
861                                         struct binder_proc *proc,
862                                         struct list_head *list)
863 {
864         struct binder_work *w;
865
866         binder_inner_proc_lock(proc);
867         w = binder_dequeue_work_head_ilocked(list);
868         binder_inner_proc_unlock(proc);
869         return w;
870 }
871
872 static void
873 binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
874 static void binder_free_thread(struct binder_thread *thread);
875 static void binder_free_proc(struct binder_proc *proc);
876 static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
877
878 static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
879 {
880         struct files_struct *files = proc->files;
881         unsigned long rlim_cur;
882         unsigned long irqs;
883
884         if (files == NULL)
885                 return -ESRCH;
886
887         if (!lock_task_sighand(proc->tsk, &irqs))
888                 return -EMFILE;
889
890         rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
891         unlock_task_sighand(proc->tsk, &irqs);
892
893         return __alloc_fd(files, 0, rlim_cur, flags);
894 }
895
896 /*
897  * copied from fd_install
898  */
899 static void task_fd_install(
900         struct binder_proc *proc, unsigned int fd, struct file *file)
901 {
902         if (proc->files)
903                 __fd_install(proc->files, fd, file);
904 }
905
906 /*
907  * copied from sys_close
908  */
909 static long task_close_fd(struct binder_proc *proc, unsigned int fd)
910 {
911         int retval;
912
913         if (proc->files == NULL)
914                 return -ESRCH;
915
916         retval = __close_fd(proc->files, fd);
917         /* can't restart close syscall because file table entry was cleared */
918         if (unlikely(retval == -ERESTARTSYS ||
919                      retval == -ERESTARTNOINTR ||
920                      retval == -ERESTARTNOHAND ||
921                      retval == -ERESTART_RESTARTBLOCK))
922                 retval = -EINTR;
923
924         return retval;
925 }
926
927 static bool binder_has_work_ilocked(struct binder_thread *thread,
928                                     bool do_proc_work)
929 {
930         return !binder_worklist_empty_ilocked(&thread->todo) ||
931                 thread->looper_need_return ||
932                 (do_proc_work &&
933                  !binder_worklist_empty_ilocked(&thread->proc->todo));
934 }
935
936 static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)
937 {
938         bool has_work;
939
940         binder_inner_proc_lock(thread->proc);
941         has_work = binder_has_work_ilocked(thread, do_proc_work);
942         binder_inner_proc_unlock(thread->proc);
943
944         return has_work;
945 }
946
947 static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)
948 {
949         return !thread->transaction_stack &&
950                 binder_worklist_empty_ilocked(&thread->todo) &&
951                 (thread->looper & (BINDER_LOOPER_STATE_ENTERED |
952                                    BINDER_LOOPER_STATE_REGISTERED));
953 }
954
955 static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,
956                                                bool sync)
957 {
958         struct rb_node *n;
959         struct binder_thread *thread;
960
961         for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {
962                 thread = rb_entry(n, struct binder_thread, rb_node);
963                 if (thread->looper & BINDER_LOOPER_STATE_POLL &&
964                     binder_available_for_proc_work_ilocked(thread)) {
965                         if (sync)
966                                 wake_up_interruptible_sync(&thread->wait);
967                         else
968                                 wake_up_interruptible(&thread->wait);
969                 }
970         }
971 }
972
973 /**
974  * binder_select_thread_ilocked() - selects a thread for doing proc work.
975  * @proc:       process to select a thread from
976  *
977  * Note that calling this function moves the thread off the waiting_threads
978  * list, so it can only be woken up by the caller of this function, or a
979  * signal. Therefore, callers *should* always wake up the thread this function
980  * returns.
981  *
982  * Return:      If there's a thread currently waiting for process work,
983  *              returns that thread. Otherwise returns NULL.
984  */
985 static struct binder_thread *
986 binder_select_thread_ilocked(struct binder_proc *proc)
987 {
988         struct binder_thread *thread;
989
990         assert_spin_locked(&proc->inner_lock);
991         thread = list_first_entry_or_null(&proc->waiting_threads,
992                                           struct binder_thread,
993                                           waiting_thread_node);
994
995         if (thread)
996                 list_del_init(&thread->waiting_thread_node);
997
998         return thread;
999 }
1000
1001 /**
1002  * binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work.
1003  * @proc:       process to wake up a thread in
1004  * @thread:     specific thread to wake-up (may be NULL)
1005  * @sync:       whether to do a synchronous wake-up
1006  *
1007  * This function wakes up a thread in the @proc process.
1008  * The caller may provide a specific thread to wake-up in
1009  * the @thread parameter. If @thread is NULL, this function
1010  * will wake up threads that have called poll().
1011  *
1012  * Note that for this function to work as expected, callers
1013  * should first call binder_select_thread() to find a thread
1014  * to handle the work (if they don't have a thread already),
1015  * and pass the result into the @thread parameter.
1016  */
1017 static void binder_wakeup_thread_ilocked(struct binder_proc *proc,
1018                                          struct binder_thread *thread,
1019                                          bool sync)
1020 {
1021         assert_spin_locked(&proc->inner_lock);
1022
1023         if (thread) {
1024                 if (sync)
1025                         wake_up_interruptible_sync(&thread->wait);
1026                 else
1027                         wake_up_interruptible(&thread->wait);
1028                 return;
1029         }
1030
1031         /* Didn't find a thread waiting for proc work; this can happen
1032          * in two scenarios:
1033          * 1. All threads are busy handling transactions
1034          *    In that case, one of those threads should call back into
1035          *    the kernel driver soon and pick up this work.
1036          * 2. Threads are using the (e)poll interface, in which case
1037          *    they may be blocked on the waitqueue without having been
1038          *    added to waiting_threads. For this case, we just iterate
1039          *    over all threads not handling transaction work, and
1040          *    wake them all up. We wake all because we don't know whether
1041          *    a thread that called into (e)poll is handling non-binder
1042          *    work currently.
1043          */
1044         binder_wakeup_poll_threads_ilocked(proc, sync);
1045 }
1046
1047 static void binder_wakeup_proc_ilocked(struct binder_proc *proc)
1048 {
1049         struct binder_thread *thread = binder_select_thread_ilocked(proc);
1050
1051         binder_wakeup_thread_ilocked(proc, thread, /* sync = */false);
1052 }
1053
1054 static void binder_set_nice(long nice)
1055 {
1056         long min_nice;
1057
1058         if (can_nice(current, nice)) {
1059                 set_user_nice(current, nice);
1060                 return;
1061         }
1062         min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));
1063         binder_debug(BINDER_DEBUG_PRIORITY_CAP,
1064                      "%d: nice value %ld not allowed use %ld instead\n",
1065                       current->pid, nice, min_nice);
1066         set_user_nice(current, min_nice);
1067         if (min_nice <= MAX_NICE)
1068                 return;
1069         binder_user_error("%d RLIMIT_NICE not set\n", current->pid);
1070 }
1071
1072 static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,
1073                                                    binder_uintptr_t ptr)
1074 {
1075         struct rb_node *n = proc->nodes.rb_node;
1076         struct binder_node *node;
1077
1078         assert_spin_locked(&proc->inner_lock);
1079
1080         while (n) {
1081                 node = rb_entry(n, struct binder_node, rb_node);
1082
1083                 if (ptr < node->ptr)
1084                         n = n->rb_left;
1085                 else if (ptr > node->ptr)
1086                         n = n->rb_right;
1087                 else {
1088                         /*
1089                          * take an implicit weak reference
1090                          * to ensure node stays alive until
1091                          * call to binder_put_node()
1092                          */
1093                         binder_inc_node_tmpref_ilocked(node);
1094                         return node;
1095                 }
1096         }
1097         return NULL;
1098 }
1099
1100 static struct binder_node *binder_get_node(struct binder_proc *proc,
1101                                            binder_uintptr_t ptr)
1102 {
1103         struct binder_node *node;
1104
1105         binder_inner_proc_lock(proc);
1106         node = binder_get_node_ilocked(proc, ptr);
1107         binder_inner_proc_unlock(proc);
1108         return node;
1109 }
1110
1111 static struct binder_node *binder_init_node_ilocked(
1112                                                 struct binder_proc *proc,
1113                                                 struct binder_node *new_node,
1114                                                 struct flat_binder_object *fp)
1115 {
1116         struct rb_node **p = &proc->nodes.rb_node;
1117         struct rb_node *parent = NULL;
1118         struct binder_node *node;
1119         binder_uintptr_t ptr = fp ? fp->binder : 0;
1120         binder_uintptr_t cookie = fp ? fp->cookie : 0;
1121         __u32 flags = fp ? fp->flags : 0;
1122
1123         assert_spin_locked(&proc->inner_lock);
1124
1125         while (*p) {
1126
1127                 parent = *p;
1128                 node = rb_entry(parent, struct binder_node, rb_node);
1129
1130                 if (ptr < node->ptr)
1131                         p = &(*p)->rb_left;
1132                 else if (ptr > node->ptr)
1133                         p = &(*p)->rb_right;
1134                 else {
1135                         /*
1136                          * A matching node is already in
1137                          * the rb tree. Abandon the init
1138                          * and return it.
1139                          */
1140                         binder_inc_node_tmpref_ilocked(node);
1141                         return node;
1142                 }
1143         }
1144         node = new_node;
1145         binder_stats_created(BINDER_STAT_NODE);
1146         node->tmp_refs++;
1147         rb_link_node(&node->rb_node, parent, p);
1148         rb_insert_color(&node->rb_node, &proc->nodes);
1149         node->debug_id = atomic_inc_return(&binder_last_id);
1150         node->proc = proc;
1151         node->ptr = ptr;
1152         node->cookie = cookie;
1153         node->work.type = BINDER_WORK_NODE;
1154         node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;
1155         node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);
1156         spin_lock_init(&node->lock);
1157         INIT_LIST_HEAD(&node->work.entry);
1158         INIT_LIST_HEAD(&node->async_todo);
1159         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1160                      "%d:%d node %d u%016llx c%016llx created\n",
1161                      proc->pid, current->pid, node->debug_id,
1162                      (u64)node->ptr, (u64)node->cookie);
1163
1164         return node;
1165 }
1166
1167 static struct binder_node *binder_new_node(struct binder_proc *proc,
1168                                            struct flat_binder_object *fp)
1169 {
1170         struct binder_node *node;
1171         struct binder_node *new_node = kzalloc(sizeof(*node), GFP_KERNEL);
1172
1173         if (!new_node)
1174                 return NULL;
1175         binder_inner_proc_lock(proc);
1176         node = binder_init_node_ilocked(proc, new_node, fp);
1177         binder_inner_proc_unlock(proc);
1178         if (node != new_node)
1179                 /*
1180                  * The node was already added by another thread
1181                  */
1182                 kfree(new_node);
1183
1184         return node;
1185 }
1186
1187 static void binder_free_node(struct binder_node *node)
1188 {
1189         kfree(node);
1190         binder_stats_deleted(BINDER_STAT_NODE);
1191 }
1192
1193 static int binder_inc_node_nilocked(struct binder_node *node, int strong,
1194                                     int internal,
1195                                     struct list_head *target_list)
1196 {
1197         struct binder_proc *proc = node->proc;
1198
1199         assert_spin_locked(&node->lock);
1200         if (proc)
1201                 assert_spin_locked(&proc->inner_lock);
1202         if (strong) {
1203                 if (internal) {
1204                         if (target_list == NULL &&
1205                             node->internal_strong_refs == 0 &&
1206                             !(node->proc &&
1207                               node == node->proc->context->binder_context_mgr_node &&
1208                               node->has_strong_ref)) {
1209                                 pr_err("invalid inc strong node for %d\n",
1210                                         node->debug_id);
1211                                 return -EINVAL;
1212                         }
1213                         node->internal_strong_refs++;
1214                 } else
1215                         node->local_strong_refs++;
1216                 if (!node->has_strong_ref && target_list) {
1217                         binder_dequeue_work_ilocked(&node->work);
1218                         binder_enqueue_work_ilocked(&node->work, target_list);
1219                 }
1220         } else {
1221                 if (!internal)
1222                         node->local_weak_refs++;
1223                 if (!node->has_weak_ref && list_empty(&node->work.entry)) {
1224                         if (target_list == NULL) {
1225                                 pr_err("invalid inc weak node for %d\n",
1226                                         node->debug_id);
1227                                 return -EINVAL;
1228                         }
1229                         binder_enqueue_work_ilocked(&node->work, target_list);
1230                 }
1231         }
1232         return 0;
1233 }
1234
1235 static int binder_inc_node(struct binder_node *node, int strong, int internal,
1236                            struct list_head *target_list)
1237 {
1238         int ret;
1239
1240         binder_node_inner_lock(node);
1241         ret = binder_inc_node_nilocked(node, strong, internal, target_list);
1242         binder_node_inner_unlock(node);
1243
1244         return ret;
1245 }
1246
1247 static bool binder_dec_node_nilocked(struct binder_node *node,
1248                                      int strong, int internal)
1249 {
1250         struct binder_proc *proc = node->proc;
1251
1252         assert_spin_locked(&node->lock);
1253         if (proc)
1254                 assert_spin_locked(&proc->inner_lock);
1255         if (strong) {
1256                 if (internal)
1257                         node->internal_strong_refs--;
1258                 else
1259                         node->local_strong_refs--;
1260                 if (node->local_strong_refs || node->internal_strong_refs)
1261                         return false;
1262         } else {
1263                 if (!internal)
1264                         node->local_weak_refs--;
1265                 if (node->local_weak_refs || node->tmp_refs ||
1266                                 !hlist_empty(&node->refs))
1267                         return false;
1268         }
1269
1270         if (proc && (node->has_strong_ref || node->has_weak_ref)) {
1271                 if (list_empty(&node->work.entry)) {
1272                         binder_enqueue_work_ilocked(&node->work, &proc->todo);
1273                         binder_wakeup_proc_ilocked(proc);
1274                 }
1275         } else {
1276                 if (hlist_empty(&node->refs) && !node->local_strong_refs &&
1277                     !node->local_weak_refs && !node->tmp_refs) {
1278                         if (proc) {
1279                                 binder_dequeue_work_ilocked(&node->work);
1280                                 rb_erase(&node->rb_node, &proc->nodes);
1281                                 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1282                                              "refless node %d deleted\n",
1283                                              node->debug_id);
1284                         } else {
1285                                 BUG_ON(!list_empty(&node->work.entry));
1286                                 spin_lock(&binder_dead_nodes_lock);
1287                                 /*
1288                                  * tmp_refs could have changed so
1289                                  * check it again
1290                                  */
1291                                 if (node->tmp_refs) {
1292                                         spin_unlock(&binder_dead_nodes_lock);
1293                                         return false;
1294                                 }
1295                                 hlist_del(&node->dead_node);
1296                                 spin_unlock(&binder_dead_nodes_lock);
1297                                 binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1298                                              "dead node %d deleted\n",
1299                                              node->debug_id);
1300                         }
1301                         return true;
1302                 }
1303         }
1304         return false;
1305 }
1306
1307 static void binder_dec_node(struct binder_node *node, int strong, int internal)
1308 {
1309         bool free_node;
1310
1311         binder_node_inner_lock(node);
1312         free_node = binder_dec_node_nilocked(node, strong, internal);
1313         binder_node_inner_unlock(node);
1314         if (free_node)
1315                 binder_free_node(node);
1316 }
1317
1318 static void binder_inc_node_tmpref_ilocked(struct binder_node *node)
1319 {
1320         /*
1321          * No call to binder_inc_node() is needed since we
1322          * don't need to inform userspace of any changes to
1323          * tmp_refs
1324          */
1325         node->tmp_refs++;
1326 }
1327
1328 /**
1329  * binder_inc_node_tmpref() - take a temporary reference on node
1330  * @node:       node to reference
1331  *
1332  * Take reference on node to prevent the node from being freed
1333  * while referenced only by a local variable. The inner lock is
1334  * needed to serialize with the node work on the queue (which
1335  * isn't needed after the node is dead). If the node is dead
1336  * (node->proc is NULL), use binder_dead_nodes_lock to protect
1337  * node->tmp_refs against dead-node-only cases where the node
1338  * lock cannot be acquired (eg traversing the dead node list to
1339  * print nodes)
1340  */
1341 static void binder_inc_node_tmpref(struct binder_node *node)
1342 {
1343         binder_node_lock(node);
1344         if (node->proc)
1345                 binder_inner_proc_lock(node->proc);
1346         else
1347                 spin_lock(&binder_dead_nodes_lock);
1348         binder_inc_node_tmpref_ilocked(node);
1349         if (node->proc)
1350                 binder_inner_proc_unlock(node->proc);
1351         else
1352                 spin_unlock(&binder_dead_nodes_lock);
1353         binder_node_unlock(node);
1354 }
1355
1356 /**
1357  * binder_dec_node_tmpref() - remove a temporary reference on node
1358  * @node:       node to reference
1359  *
1360  * Release temporary reference on node taken via binder_inc_node_tmpref()
1361  */
1362 static void binder_dec_node_tmpref(struct binder_node *node)
1363 {
1364         bool free_node;
1365
1366         binder_node_inner_lock(node);
1367         if (!node->proc)
1368                 spin_lock(&binder_dead_nodes_lock);
1369         node->tmp_refs--;
1370         BUG_ON(node->tmp_refs < 0);
1371         if (!node->proc)
1372                 spin_unlock(&binder_dead_nodes_lock);
1373         /*
1374          * Call binder_dec_node() to check if all refcounts are 0
1375          * and cleanup is needed. Calling with strong=0 and internal=1
1376          * causes no actual reference to be released in binder_dec_node().
1377          * If that changes, a change is needed here too.
1378          */
1379         free_node = binder_dec_node_nilocked(node, 0, 1);
1380         binder_node_inner_unlock(node);
1381         if (free_node)
1382                 binder_free_node(node);
1383 }
1384
1385 static void binder_put_node(struct binder_node *node)
1386 {
1387         binder_dec_node_tmpref(node);
1388 }
1389
1390 static struct binder_ref *binder_get_ref_olocked(struct binder_proc *proc,
1391                                                  u32 desc, bool need_strong_ref)
1392 {
1393         struct rb_node *n = proc->refs_by_desc.rb_node;
1394         struct binder_ref *ref;
1395
1396         while (n) {
1397                 ref = rb_entry(n, struct binder_ref, rb_node_desc);
1398
1399                 if (desc < ref->data.desc) {
1400                         n = n->rb_left;
1401                 } else if (desc > ref->data.desc) {
1402                         n = n->rb_right;
1403                 } else if (need_strong_ref && !ref->data.strong) {
1404                         binder_user_error("tried to use weak ref as strong ref\n");
1405                         return NULL;
1406                 } else {
1407                         return ref;
1408                 }
1409         }
1410         return NULL;
1411 }
1412
1413 /**
1414  * binder_get_ref_for_node_olocked() - get the ref associated with given node
1415  * @proc:       binder_proc that owns the ref
1416  * @node:       binder_node of target
1417  * @new_ref:    newly allocated binder_ref to be initialized or %NULL
1418  *
1419  * Look up the ref for the given node and return it if it exists
1420  *
1421  * If it doesn't exist and the caller provides a newly allocated
1422  * ref, initialize the fields of the newly allocated ref and insert
1423  * into the given proc rb_trees and node refs list.
1424  *
1425  * Return:      the ref for node. It is possible that another thread
1426  *              allocated/initialized the ref first in which case the
1427  *              returned ref would be different than the passed-in
1428  *              new_ref. new_ref must be kfree'd by the caller in
1429  *              this case.
1430  */
1431 static struct binder_ref *binder_get_ref_for_node_olocked(
1432                                         struct binder_proc *proc,
1433                                         struct binder_node *node,
1434                                         struct binder_ref *new_ref)
1435 {
1436         struct binder_context *context = proc->context;
1437         struct rb_node **p = &proc->refs_by_node.rb_node;
1438         struct rb_node *parent = NULL;
1439         struct binder_ref *ref;
1440         struct rb_node *n;
1441
1442         while (*p) {
1443                 parent = *p;
1444                 ref = rb_entry(parent, struct binder_ref, rb_node_node);
1445
1446                 if (node < ref->node)
1447                         p = &(*p)->rb_left;
1448                 else if (node > ref->node)
1449                         p = &(*p)->rb_right;
1450                 else
1451                         return ref;
1452         }
1453         if (!new_ref)
1454                 return NULL;
1455
1456         binder_stats_created(BINDER_STAT_REF);
1457         new_ref->data.debug_id = atomic_inc_return(&binder_last_id);
1458         new_ref->proc = proc;
1459         new_ref->node = node;
1460         rb_link_node(&new_ref->rb_node_node, parent, p);
1461         rb_insert_color(&new_ref->rb_node_node, &proc->refs_by_node);
1462
1463         new_ref->data.desc = (node == context->binder_context_mgr_node) ? 0 : 1;
1464         for (n = rb_first(&proc->refs_by_desc); n != NULL; n = rb_next(n)) {
1465                 ref = rb_entry(n, struct binder_ref, rb_node_desc);
1466                 if (ref->data.desc > new_ref->data.desc)
1467                         break;
1468                 new_ref->data.desc = ref->data.desc + 1;
1469         }
1470
1471         p = &proc->refs_by_desc.rb_node;
1472         while (*p) {
1473                 parent = *p;
1474                 ref = rb_entry(parent, struct binder_ref, rb_node_desc);
1475
1476                 if (new_ref->data.desc < ref->data.desc)
1477                         p = &(*p)->rb_left;
1478                 else if (new_ref->data.desc > ref->data.desc)
1479                         p = &(*p)->rb_right;
1480                 else
1481                         BUG();
1482         }
1483         rb_link_node(&new_ref->rb_node_desc, parent, p);
1484         rb_insert_color(&new_ref->rb_node_desc, &proc->refs_by_desc);
1485
1486         binder_node_lock(node);
1487         hlist_add_head(&new_ref->node_entry, &node->refs);
1488
1489         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1490                      "%d new ref %d desc %d for node %d\n",
1491                       proc->pid, new_ref->data.debug_id, new_ref->data.desc,
1492                       node->debug_id);
1493         binder_node_unlock(node);
1494         return new_ref;
1495 }
1496
1497 static void binder_cleanup_ref_olocked(struct binder_ref *ref)
1498 {
1499         bool delete_node = false;
1500
1501         binder_debug(BINDER_DEBUG_INTERNAL_REFS,
1502                      "%d delete ref %d desc %d for node %d\n",
1503                       ref->proc->pid, ref->data.debug_id, ref->data.desc,
1504                       ref->node->debug_id);
1505
1506         rb_erase(&ref->rb_node_desc, &ref->proc->refs_by_desc);
1507         rb_erase(&ref->rb_node_node, &ref->proc->refs_by_node);
1508
1509         binder_node_inner_lock(ref->node);
1510         if (ref->data.strong)
1511                 binder_dec_node_nilocked(ref->node, 1, 1);
1512
1513         hlist_del(&ref->node_entry);
1514         delete_node = binder_dec_node_nilocked(ref->node, 0, 1);
1515         binder_node_inner_unlock(ref->node);
1516         /*
1517          * Clear ref->node unless we want the caller to free the node
1518          */
1519         if (!delete_node) {
1520                 /*
1521                  * The caller uses ref->node to determine
1522                  * whether the node needs to be freed. Clear
1523                  * it since the node is still alive.
1524                  */
1525                 ref->node = NULL;
1526         }
1527
1528         if (ref->death) {
1529                 binder_debug(BINDER_DEBUG_DEAD_BINDER,
1530                              "%d delete ref %d desc %d has death notification\n",
1531                               ref->proc->pid, ref->data.debug_id,
1532                               ref->data.desc);
1533                 binder_dequeue_work(ref->proc, &ref->death->work);
1534                 binder_stats_deleted(BINDER_STAT_DEATH);
1535         }
1536         binder_stats_deleted(BINDER_STAT_REF);
1537 }
1538
1539 /**
1540  * binder_inc_ref_olocked() - increment the ref for given handle
1541  * @ref:         ref to be incremented
1542  * @strong:      if true, strong increment, else weak
1543  * @target_list: list to queue node work on
1544  *
1545  * Increment the ref. @ref->proc->outer_lock must be held on entry
1546  *
1547  * Return: 0, if successful, else errno
1548  */
1549 static int binder_inc_ref_olocked(struct binder_ref *ref, int strong,
1550                                   struct list_head *target_list)
1551 {
1552         int ret;
1553
1554         if (strong) {
1555                 if (ref->data.strong == 0) {
1556                         ret = binder_inc_node(ref->node, 1, 1, target_list);
1557                         if (ret)
1558                                 return ret;
1559                 }
1560                 ref->data.strong++;
1561         } else {
1562                 if (ref->data.weak == 0) {
1563                         ret = binder_inc_node(ref->node, 0, 1, target_list);
1564                         if (ret)
1565                                 return ret;
1566                 }
1567                 ref->data.weak++;
1568         }
1569         return 0;
1570 }
1571
1572 /**
1573  * binder_dec_ref() - dec the ref for given handle
1574  * @ref:        ref to be decremented
1575  * @strong:     if true, strong decrement, else weak
1576  *
1577  * Decrement the ref.
1578  *
1579  * Return: true if ref is cleaned up and ready to be freed
1580  */
1581 static bool binder_dec_ref_olocked(struct binder_ref *ref, int strong)
1582 {
1583         if (strong) {
1584                 if (ref->data.strong == 0) {
1585                         binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
1586                                           ref->proc->pid, ref->data.debug_id,
1587                                           ref->data.desc, ref->data.strong,
1588                                           ref->data.weak);
1589                         return false;
1590                 }
1591                 ref->data.strong--;
1592                 if (ref->data.strong == 0)
1593                         binder_dec_node(ref->node, strong, 1);
1594         } else {
1595                 if (ref->data.weak == 0) {
1596                         binder_user_error("%d invalid dec weak, ref %d desc %d s %d w %d\n",
1597                                           ref->proc->pid, ref->data.debug_id,
1598                                           ref->data.desc, ref->data.strong,
1599                                           ref->data.weak);
1600                         return false;
1601                 }
1602                 ref->data.weak--;
1603         }
1604         if (ref->data.strong == 0 && ref->data.weak == 0) {
1605                 binder_cleanup_ref_olocked(ref);
1606                 return true;
1607         }
1608         return false;
1609 }
1610
1611 /**
1612  * binder_get_node_from_ref() - get the node from the given proc/desc
1613  * @proc:       proc containing the ref
1614  * @desc:       the handle associated with the ref
1615  * @need_strong_ref: if true, only return node if ref is strong
1616  * @rdata:      the id/refcount data for the ref
1617  *
1618  * Given a proc and ref handle, return the associated binder_node
1619  *
1620  * Return: a binder_node or NULL if not found or not strong when strong required
1621  */
1622 static struct binder_node *binder_get_node_from_ref(
1623                 struct binder_proc *proc,
1624                 u32 desc, bool need_strong_ref,
1625                 struct binder_ref_data *rdata)
1626 {
1627         struct binder_node *node;
1628         struct binder_ref *ref;
1629
1630         binder_proc_lock(proc);
1631         ref = binder_get_ref_olocked(proc, desc, need_strong_ref);
1632         if (!ref)
1633                 goto err_no_ref;
1634         node = ref->node;
1635         /*
1636          * Take an implicit reference on the node to ensure
1637          * it stays alive until the call to binder_put_node()
1638          */
1639         binder_inc_node_tmpref(node);
1640         if (rdata)
1641                 *rdata = ref->data;
1642         binder_proc_unlock(proc);
1643
1644         return node;
1645
1646 err_no_ref:
1647         binder_proc_unlock(proc);
1648         return NULL;
1649 }
1650
1651 /**
1652  * binder_free_ref() - free the binder_ref
1653  * @ref:        ref to free
1654  *
1655  * Free the binder_ref. Free the binder_node indicated by ref->node
1656  * (if non-NULL) and the binder_ref_death indicated by ref->death.
1657  */
1658 static void binder_free_ref(struct binder_ref *ref)
1659 {
1660         if (ref->node)
1661                 binder_free_node(ref->node);
1662         kfree(ref->death);
1663         kfree(ref);
1664 }
1665
1666 /**
1667  * binder_update_ref_for_handle() - inc/dec the ref for given handle
1668  * @proc:       proc containing the ref
1669  * @desc:       the handle associated with the ref
1670  * @increment:  true=inc reference, false=dec reference
1671  * @strong:     true=strong reference, false=weak reference
1672  * @rdata:      the id/refcount data for the ref
1673  *
1674  * Given a proc and ref handle, increment or decrement the ref
1675  * according to "increment" arg.
1676  *
1677  * Return: 0 if successful, else errno
1678  */
1679 static int binder_update_ref_for_handle(struct binder_proc *proc,
1680                 uint32_t desc, bool increment, bool strong,
1681                 struct binder_ref_data *rdata)
1682 {
1683         int ret = 0;
1684         struct binder_ref *ref;
1685         bool delete_ref = false;
1686
1687         binder_proc_lock(proc);
1688         ref = binder_get_ref_olocked(proc, desc, strong);
1689         if (!ref) {
1690                 ret = -EINVAL;
1691                 goto err_no_ref;
1692         }
1693         if (increment)
1694                 ret = binder_inc_ref_olocked(ref, strong, NULL);
1695         else
1696                 delete_ref = binder_dec_ref_olocked(ref, strong);
1697
1698         if (rdata)
1699                 *rdata = ref->data;
1700         binder_proc_unlock(proc);
1701
1702         if (delete_ref)
1703                 binder_free_ref(ref);
1704         return ret;
1705
1706 err_no_ref:
1707         binder_proc_unlock(proc);
1708         return ret;
1709 }
1710
1711 /**
1712  * binder_dec_ref_for_handle() - dec the ref for given handle
1713  * @proc:       proc containing the ref
1714  * @desc:       the handle associated with the ref
1715  * @strong:     true=strong reference, false=weak reference
1716  * @rdata:      the id/refcount data for the ref
1717  *
1718  * Just calls binder_update_ref_for_handle() to decrement the ref.
1719  *
1720  * Return: 0 if successful, else errno
1721  */
1722 static int binder_dec_ref_for_handle(struct binder_proc *proc,
1723                 uint32_t desc, bool strong, struct binder_ref_data *rdata)
1724 {
1725         return binder_update_ref_for_handle(proc, desc, false, strong, rdata);
1726 }
1727
1728
1729 /**
1730  * binder_inc_ref_for_node() - increment the ref for given proc/node
1731  * @proc:        proc containing the ref
1732  * @node:        target node
1733  * @strong:      true=strong reference, false=weak reference
1734  * @target_list: worklist to use if node is incremented
1735  * @rdata:       the id/refcount data for the ref
1736  *
1737  * Given a proc and node, increment the ref. Create the ref if it
1738  * doesn't already exist
1739  *
1740  * Return: 0 if successful, else errno
1741  */
1742 static int binder_inc_ref_for_node(struct binder_proc *proc,
1743                         struct binder_node *node,
1744                         bool strong,
1745                         struct list_head *target_list,
1746                         struct binder_ref_data *rdata)
1747 {
1748         struct binder_ref *ref;
1749         struct binder_ref *new_ref = NULL;
1750         int ret = 0;
1751
1752         binder_proc_lock(proc);
1753         ref = binder_get_ref_for_node_olocked(proc, node, NULL);
1754         if (!ref) {
1755                 binder_proc_unlock(proc);
1756                 new_ref = kzalloc(sizeof(*ref), GFP_KERNEL);
1757                 if (!new_ref)
1758                         return -ENOMEM;
1759                 binder_proc_lock(proc);
1760                 ref = binder_get_ref_for_node_olocked(proc, node, new_ref);
1761         }
1762         ret = binder_inc_ref_olocked(ref, strong, target_list);
1763         *rdata = ref->data;
1764         binder_proc_unlock(proc);
1765         if (new_ref && ref != new_ref)
1766                 /*
1767                  * Another thread created the ref first so
1768                  * free the one we allocated
1769                  */
1770                 kfree(new_ref);
1771         return ret;
1772 }
1773
1774 static void binder_pop_transaction_ilocked(struct binder_thread *target_thread,
1775                                            struct binder_transaction *t)
1776 {
1777         BUG_ON(!target_thread);
1778         assert_spin_locked(&target_thread->proc->inner_lock);
1779         BUG_ON(target_thread->transaction_stack != t);
1780         BUG_ON(target_thread->transaction_stack->from != target_thread);
1781         target_thread->transaction_stack =
1782                 target_thread->transaction_stack->from_parent;
1783         t->from = NULL;
1784 }
1785
1786 /**
1787  * binder_thread_dec_tmpref() - decrement thread->tmp_ref
1788  * @thread:     thread to decrement
1789  *
1790  * A thread needs to be kept alive while being used to create or
1791  * handle a transaction. binder_get_txn_from() is used to safely
1792  * extract t->from from a binder_transaction and keep the thread
1793  * indicated by t->from from being freed. When done with that
1794  * binder_thread, this function is called to decrement the
1795  * tmp_ref and free if appropriate (thread has been released
1796  * and no transaction being processed by the driver)
1797  */
1798 static void binder_thread_dec_tmpref(struct binder_thread *thread)
1799 {
1800         /*
1801          * atomic is used to protect the counter value while
1802          * it cannot reach zero or thread->is_dead is false
1803          */
1804         binder_inner_proc_lock(thread->proc);
1805         atomic_dec(&thread->tmp_ref);
1806         if (thread->is_dead && !atomic_read(&thread->tmp_ref)) {
1807                 binder_inner_proc_unlock(thread->proc);
1808                 binder_free_thread(thread);
1809                 return;
1810         }
1811         binder_inner_proc_unlock(thread->proc);
1812 }
1813
1814 /**
1815  * binder_proc_dec_tmpref() - decrement proc->tmp_ref
1816  * @proc:       proc to decrement
1817  *
1818  * A binder_proc needs to be kept alive while being used to create or
1819  * handle a transaction. proc->tmp_ref is incremented when
1820  * creating a new transaction or the binder_proc is currently in-use
1821  * by threads that are being released. When done with the binder_proc,
1822  * this function is called to decrement the counter and free the
1823  * proc if appropriate (proc has been released, all threads have
1824  * been released and not currenly in-use to process a transaction).
1825  */
1826 static void binder_proc_dec_tmpref(struct binder_proc *proc)
1827 {
1828         binder_inner_proc_lock(proc);
1829         proc->tmp_ref--;
1830         if (proc->is_dead && RB_EMPTY_ROOT(&proc->threads) &&
1831                         !proc->tmp_ref) {
1832                 binder_inner_proc_unlock(proc);
1833                 binder_free_proc(proc);
1834                 return;
1835         }
1836         binder_inner_proc_unlock(proc);
1837 }
1838
1839 /**
1840  * binder_get_txn_from() - safely extract the "from" thread in transaction
1841  * @t:  binder transaction for t->from
1842  *
1843  * Atomically return the "from" thread and increment the tmp_ref
1844  * count for the thread to ensure it stays alive until
1845  * binder_thread_dec_tmpref() is called.
1846  *
1847  * Return: the value of t->from
1848  */
1849 static struct binder_thread *binder_get_txn_from(
1850                 struct binder_transaction *t)
1851 {
1852         struct binder_thread *from;
1853
1854         spin_lock(&t->lock);
1855         from = t->from;
1856         if (from)
1857                 atomic_inc(&from->tmp_ref);
1858         spin_unlock(&t->lock);
1859         return from;
1860 }
1861
1862 /**
1863  * binder_get_txn_from_and_acq_inner() - get t->from and acquire inner lock
1864  * @t:  binder transaction for t->from
1865  *
1866  * Same as binder_get_txn_from() except it also acquires the proc->inner_lock
1867  * to guarantee that the thread cannot be released while operating on it.
1868  * The caller must call binder_inner_proc_unlock() to release the inner lock
1869  * as well as call binder_dec_thread_txn() to release the reference.
1870  *
1871  * Return: the value of t->from
1872  */
1873 static struct binder_thread *binder_get_txn_from_and_acq_inner(
1874                 struct binder_transaction *t)
1875 {
1876         struct binder_thread *from;
1877
1878         from = binder_get_txn_from(t);
1879         if (!from)
1880                 return NULL;
1881         binder_inner_proc_lock(from->proc);
1882         if (t->from) {
1883                 BUG_ON(from != t->from);
1884                 return from;
1885         }
1886         binder_inner_proc_unlock(from->proc);
1887         binder_thread_dec_tmpref(from);
1888         return NULL;
1889 }
1890
1891 static void binder_free_transaction(struct binder_transaction *t)
1892 {
1893         if (t->buffer)
1894                 t->buffer->transaction = NULL;
1895         kfree(t);
1896         binder_stats_deleted(BINDER_STAT_TRANSACTION);
1897 }
1898
1899 static void binder_send_failed_reply(struct binder_transaction *t,
1900                                      uint32_t error_code)
1901 {
1902         struct binder_thread *target_thread;
1903         struct binder_transaction *next;
1904
1905         BUG_ON(t->flags & TF_ONE_WAY);
1906         while (1) {
1907                 target_thread = binder_get_txn_from_and_acq_inner(t);
1908                 if (target_thread) {
1909                         binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1910                                      "send failed reply for transaction %d to %d:%d\n",
1911                                       t->debug_id,
1912                                       target_thread->proc->pid,
1913                                       target_thread->pid);
1914
1915                         binder_pop_transaction_ilocked(target_thread, t);
1916                         if (target_thread->reply_error.cmd == BR_OK) {
1917                                 target_thread->reply_error.cmd = error_code;
1918                                 binder_enqueue_work_ilocked(
1919                                         &target_thread->reply_error.work,
1920                                         &target_thread->todo);
1921                                 wake_up_interruptible(&target_thread->wait);
1922                         } else {
1923                                 WARN(1, "Unexpected reply error: %u\n",
1924                                                 target_thread->reply_error.cmd);
1925                         }
1926                         binder_inner_proc_unlock(target_thread->proc);
1927                         binder_thread_dec_tmpref(target_thread);
1928                         binder_free_transaction(t);
1929                         return;
1930                 }
1931                 next = t->from_parent;
1932
1933                 binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
1934                              "send failed reply for transaction %d, target dead\n",
1935                              t->debug_id);
1936
1937                 binder_free_transaction(t);
1938                 if (next == NULL) {
1939                         binder_debug(BINDER_DEBUG_DEAD_BINDER,
1940                                      "reply failed, no target thread at root\n");
1941                         return;
1942                 }
1943                 t = next;
1944                 binder_debug(BINDER_DEBUG_DEAD_BINDER,
1945                              "reply failed, no target thread -- retry %d\n",
1946                               t->debug_id);
1947         }
1948 }
1949
1950 /**
1951  * binder_validate_object() - checks for a valid metadata object in a buffer.
1952  * @buffer:     binder_buffer that we're parsing.
1953  * @offset:     offset in the buffer at which to validate an object.
1954  *
1955  * Return:      If there's a valid metadata object at @offset in @buffer, the
1956  *              size of that object. Otherwise, it returns zero.
1957  */
1958 static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset)
1959 {
1960         /* Check if we can read a header first */
1961         struct binder_object_header *hdr;
1962         size_t object_size = 0;
1963
1964         if (offset > buffer->data_size - sizeof(*hdr) ||
1965             buffer->data_size < sizeof(*hdr) ||
1966             !IS_ALIGNED(offset, sizeof(u32)))
1967                 return 0;
1968
1969         /* Ok, now see if we can read a complete object. */
1970         hdr = (struct binder_object_header *)(buffer->data + offset);
1971         switch (hdr->type) {
1972         case BINDER_TYPE_BINDER:
1973         case BINDER_TYPE_WEAK_BINDER:
1974         case BINDER_TYPE_HANDLE:
1975         case BINDER_TYPE_WEAK_HANDLE:
1976                 object_size = sizeof(struct flat_binder_object);
1977                 break;
1978         case BINDER_TYPE_FD:
1979                 object_size = sizeof(struct binder_fd_object);
1980                 break;
1981         case BINDER_TYPE_PTR:
1982                 object_size = sizeof(struct binder_buffer_object);
1983                 break;
1984         case BINDER_TYPE_FDA:
1985                 object_size = sizeof(struct binder_fd_array_object);
1986                 break;
1987         default:
1988                 return 0;
1989         }
1990         if (offset <= buffer->data_size - object_size &&
1991             buffer->data_size >= object_size)
1992                 return object_size;
1993         else
1994                 return 0;
1995 }
1996
1997 /**
1998  * binder_validate_ptr() - validates binder_buffer_object in a binder_buffer.
1999  * @b:          binder_buffer containing the object
2000  * @index:      index in offset array at which the binder_buffer_object is
2001  *              located
2002  * @start:      points to the start of the offset array
2003  * @num_valid:  the number of valid offsets in the offset array
2004  *
2005  * Return:      If @index is within the valid range of the offset array
2006  *              described by @start and @num_valid, and if there's a valid
2007  *              binder_buffer_object at the offset found in index @index
2008  *              of the offset array, that object is returned. Otherwise,
2009  *              %NULL is returned.
2010  *              Note that the offset found in index @index itself is not
2011  *              verified; this function assumes that @num_valid elements
2012  *              from @start were previously verified to have valid offsets.
2013  */
2014 static struct binder_buffer_object *binder_validate_ptr(struct binder_buffer *b,
2015                                                         binder_size_t index,
2016                                                         binder_size_t *start,
2017                                                         binder_size_t num_valid)
2018 {
2019         struct binder_buffer_object *buffer_obj;
2020         binder_size_t *offp;
2021
2022         if (index >= num_valid)
2023                 return NULL;
2024
2025         offp = start + index;
2026         buffer_obj = (struct binder_buffer_object *)(b->data + *offp);
2027         if (buffer_obj->hdr.type != BINDER_TYPE_PTR)
2028                 return NULL;
2029
2030         return buffer_obj;
2031 }
2032
2033 /**
2034  * binder_validate_fixup() - validates pointer/fd fixups happen in order.
2035  * @b:                  transaction buffer
2036  * @objects_start       start of objects buffer
2037  * @buffer:             binder_buffer_object in which to fix up
2038  * @offset:             start offset in @buffer to fix up
2039  * @last_obj:           last binder_buffer_object that we fixed up in
2040  * @last_min_offset:    minimum fixup offset in @last_obj
2041  *
2042  * Return:              %true if a fixup in buffer @buffer at offset @offset is
2043  *                      allowed.
2044  *
2045  * For safety reasons, we only allow fixups inside a buffer to happen
2046  * at increasing offsets; additionally, we only allow fixup on the last
2047  * buffer object that was verified, or one of its parents.
2048  *
2049  * Example of what is allowed:
2050  *
2051  * A
2052  *   B (parent = A, offset = 0)
2053  *   C (parent = A, offset = 16)
2054  *     D (parent = C, offset = 0)
2055  *   E (parent = A, offset = 32) // min_offset is 16 (C.parent_offset)
2056  *
2057  * Examples of what is not allowed:
2058  *
2059  * Decreasing offsets within the same parent:
2060  * A
2061  *   C (parent = A, offset = 16)
2062  *   B (parent = A, offset = 0) // decreasing offset within A
2063  *
2064  * Referring to a parent that wasn't the last object or any of its parents:
2065  * A
2066  *   B (parent = A, offset = 0)
2067  *   C (parent = A, offset = 0)
2068  *   C (parent = A, offset = 16)
2069  *     D (parent = B, offset = 0) // B is not A or any of A's parents
2070  */
2071 static bool binder_validate_fixup(struct binder_buffer *b,
2072                                   binder_size_t *objects_start,
2073                                   struct binder_buffer_object *buffer,
2074                                   binder_size_t fixup_offset,
2075                                   struct binder_buffer_object *last_obj,
2076                                   binder_size_t last_min_offset)
2077 {
2078         if (!last_obj) {
2079                 /* Nothing to fix up in */
2080                 return false;
2081         }
2082
2083         while (last_obj != buffer) {
2084                 /*
2085                  * Safe to retrieve the parent of last_obj, since it
2086                  * was already previously verified by the driver.
2087                  */
2088                 if ((last_obj->flags & BINDER_BUFFER_FLAG_HAS_PARENT) == 0)
2089                         return false;
2090                 last_min_offset = last_obj->parent_offset + sizeof(uintptr_t);
2091                 last_obj = (struct binder_buffer_object *)
2092                         (b->data + *(objects_start + last_obj->parent));
2093         }
2094         return (fixup_offset >= last_min_offset);
2095 }
2096
2097 static void binder_transaction_buffer_release(struct binder_proc *proc,
2098                                               struct binder_buffer *buffer,
2099                                               binder_size_t *failed_at)
2100 {
2101         binder_size_t *offp, *off_start, *off_end;
2102         int debug_id = buffer->debug_id;
2103
2104         binder_debug(BINDER_DEBUG_TRANSACTION,
2105                      "%d buffer release %d, size %zd-%zd, failed at %p\n",
2106                      proc->pid, buffer->debug_id,
2107                      buffer->data_size, buffer->offsets_size, failed_at);
2108
2109         if (buffer->target_node)
2110                 binder_dec_node(buffer->target_node, 1, 0);
2111
2112         off_start = (binder_size_t *)(buffer->data +
2113                                       ALIGN(buffer->data_size, sizeof(void *)));
2114         if (failed_at)
2115                 off_end = failed_at;
2116         else
2117                 off_end = (void *)off_start + buffer->offsets_size;
2118         for (offp = off_start; offp < off_end; offp++) {
2119                 struct binder_object_header *hdr;
2120                 size_t object_size = binder_validate_object(buffer, *offp);
2121
2122                 if (object_size == 0) {
2123                         pr_err("transaction release %d bad object at offset %lld, size %zd\n",
2124                                debug_id, (u64)*offp, buffer->data_size);
2125                         continue;
2126                 }
2127                 hdr = (struct binder_object_header *)(buffer->data + *offp);
2128                 switch (hdr->type) {
2129                 case BINDER_TYPE_BINDER:
2130                 case BINDER_TYPE_WEAK_BINDER: {
2131                         struct flat_binder_object *fp;
2132                         struct binder_node *node;
2133
2134                         fp = to_flat_binder_object(hdr);
2135                         node = binder_get_node(proc, fp->binder);
2136                         if (node == NULL) {
2137                                 pr_err("transaction release %d bad node %016llx\n",
2138                                        debug_id, (u64)fp->binder);
2139                                 break;
2140                         }
2141                         binder_debug(BINDER_DEBUG_TRANSACTION,
2142                                      "        node %d u%016llx\n",
2143                                      node->debug_id, (u64)node->ptr);
2144                         binder_dec_node(node, hdr->type == BINDER_TYPE_BINDER,
2145                                         0);
2146                         binder_put_node(node);
2147                 } break;
2148                 case BINDER_TYPE_HANDLE:
2149                 case BINDER_TYPE_WEAK_HANDLE: {
2150                         struct flat_binder_object *fp;
2151                         struct binder_ref_data rdata;
2152                         int ret;
2153
2154                         fp = to_flat_binder_object(hdr);
2155                         ret = binder_dec_ref_for_handle(proc, fp->handle,
2156                                 hdr->type == BINDER_TYPE_HANDLE, &rdata);
2157
2158                         if (ret) {
2159                                 pr_err("transaction release %d bad handle %d, ret = %d\n",
2160                                  debug_id, fp->handle, ret);
2161                                 break;
2162                         }
2163                         binder_debug(BINDER_DEBUG_TRANSACTION,
2164                                      "        ref %d desc %d\n",
2165                                      rdata.debug_id, rdata.desc);
2166                 } break;
2167
2168                 case BINDER_TYPE_FD: {
2169                         struct binder_fd_object *fp = to_binder_fd_object(hdr);
2170
2171                         binder_debug(BINDER_DEBUG_TRANSACTION,
2172                                      "        fd %d\n", fp->fd);
2173                         if (failed_at)
2174                                 task_close_fd(proc, fp->fd);
2175                 } break;
2176                 case BINDER_TYPE_PTR:
2177                         /*
2178                          * Nothing to do here, this will get cleaned up when the
2179                          * transaction buffer gets freed
2180                          */
2181                         break;
2182                 case BINDER_TYPE_FDA: {
2183                         struct binder_fd_array_object *fda;
2184                         struct binder_buffer_object *parent;
2185                         uintptr_t parent_buffer;
2186                         u32 *fd_array;
2187                         size_t fd_index;
2188                         binder_size_t fd_buf_size;
2189
2190                         fda = to_binder_fd_array_object(hdr);
2191                         parent = binder_validate_ptr(buffer, fda->parent,
2192                                                      off_start,
2193                                                      offp - off_start);
2194                         if (!parent) {
2195                                 pr_err("transaction release %d bad parent offset\n",
2196                                        debug_id);
2197                                 continue;
2198                         }
2199                         /*
2200                          * Since the parent was already fixed up, convert it
2201                          * back to kernel address space to access it
2202                          */
2203                         parent_buffer = parent->buffer -
2204                                 binder_alloc_get_user_buffer_offset(
2205                                                 &proc->alloc);
2206
2207                         fd_buf_size = sizeof(u32) * fda->num_fds;
2208                         if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2209                                 pr_err("transaction release %d invalid number of fds (%lld)\n",
2210                                        debug_id, (u64)fda->num_fds);
2211                                 continue;
2212                         }
2213                         if (fd_buf_size > parent->length ||
2214                             fda->parent_offset > parent->length - fd_buf_size) {
2215                                 /* No space for all file descriptors here. */
2216                                 pr_err("transaction release %d not enough space for %lld fds in buffer\n",
2217                                        debug_id, (u64)fda->num_fds);
2218                                 continue;
2219                         }
2220                         fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
2221                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
2222                                 task_close_fd(proc, fd_array[fd_index]);
2223                 } break;
2224                 default:
2225                         pr_err("transaction release %d bad object type %x\n",
2226                                 debug_id, hdr->type);
2227                         break;
2228                 }
2229         }
2230 }
2231
2232 static int binder_translate_binder(struct flat_binder_object *fp,
2233                                    struct binder_transaction *t,
2234                                    struct binder_thread *thread)
2235 {
2236         struct binder_node *node;
2237         struct binder_proc *proc = thread->proc;
2238         struct binder_proc *target_proc = t->to_proc;
2239         struct binder_ref_data rdata;
2240         int ret = 0;
2241
2242         node = binder_get_node(proc, fp->binder);
2243         if (!node) {
2244                 node = binder_new_node(proc, fp);
2245                 if (!node)
2246                         return -ENOMEM;
2247         }
2248         if (fp->cookie != node->cookie) {
2249                 binder_user_error("%d:%d sending u%016llx node %d, cookie mismatch %016llx != %016llx\n",
2250                                   proc->pid, thread->pid, (u64)fp->binder,
2251                                   node->debug_id, (u64)fp->cookie,
2252                                   (u64)node->cookie);
2253                 ret = -EINVAL;
2254                 goto done;
2255         }
2256         if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2257                 ret = -EPERM;
2258                 goto done;
2259         }
2260
2261         ret = binder_inc_ref_for_node(target_proc, node,
2262                         fp->hdr.type == BINDER_TYPE_BINDER,
2263                         &thread->todo, &rdata);
2264         if (ret)
2265                 goto done;
2266
2267         if (fp->hdr.type == BINDER_TYPE_BINDER)
2268                 fp->hdr.type = BINDER_TYPE_HANDLE;
2269         else
2270                 fp->hdr.type = BINDER_TYPE_WEAK_HANDLE;
2271         fp->binder = 0;
2272         fp->handle = rdata.desc;
2273         fp->cookie = 0;
2274
2275         trace_binder_transaction_node_to_ref(t, node, &rdata);
2276         binder_debug(BINDER_DEBUG_TRANSACTION,
2277                      "        node %d u%016llx -> ref %d desc %d\n",
2278                      node->debug_id, (u64)node->ptr,
2279                      rdata.debug_id, rdata.desc);
2280 done:
2281         binder_put_node(node);
2282         return ret;
2283 }
2284
2285 static int binder_translate_handle(struct flat_binder_object *fp,
2286                                    struct binder_transaction *t,
2287                                    struct binder_thread *thread)
2288 {
2289         struct binder_proc *proc = thread->proc;
2290         struct binder_proc *target_proc = t->to_proc;
2291         struct binder_node *node;
2292         struct binder_ref_data src_rdata;
2293         int ret = 0;
2294
2295         node = binder_get_node_from_ref(proc, fp->handle,
2296                         fp->hdr.type == BINDER_TYPE_HANDLE, &src_rdata);
2297         if (!node) {
2298                 binder_user_error("%d:%d got transaction with invalid handle, %d\n",
2299                                   proc->pid, thread->pid, fp->handle);
2300                 return -EINVAL;
2301         }
2302         if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) {
2303                 ret = -EPERM;
2304                 goto done;
2305         }
2306
2307         binder_node_lock(node);
2308         if (node->proc == target_proc) {
2309                 if (fp->hdr.type == BINDER_TYPE_HANDLE)
2310                         fp->hdr.type = BINDER_TYPE_BINDER;
2311                 else
2312                         fp->hdr.type = BINDER_TYPE_WEAK_BINDER;
2313                 fp->binder = node->ptr;
2314                 fp->cookie = node->cookie;
2315                 if (node->proc)
2316                         binder_inner_proc_lock(node->proc);
2317                 binder_inc_node_nilocked(node,
2318                                          fp->hdr.type == BINDER_TYPE_BINDER,
2319                                          0, NULL);
2320                 if (node->proc)
2321                         binder_inner_proc_unlock(node->proc);
2322                 trace_binder_transaction_ref_to_node(t, node, &src_rdata);
2323                 binder_debug(BINDER_DEBUG_TRANSACTION,
2324                              "        ref %d desc %d -> node %d u%016llx\n",
2325                              src_rdata.debug_id, src_rdata.desc, node->debug_id,
2326                              (u64)node->ptr);
2327                 binder_node_unlock(node);
2328         } else {
2329                 struct binder_ref_data dest_rdata;
2330
2331                 binder_node_unlock(node);
2332                 ret = binder_inc_ref_for_node(target_proc, node,
2333                                 fp->hdr.type == BINDER_TYPE_HANDLE,
2334                                 NULL, &dest_rdata);
2335                 if (ret)
2336                         goto done;
2337
2338                 fp->binder = 0;
2339                 fp->handle = dest_rdata.desc;
2340                 fp->cookie = 0;
2341                 trace_binder_transaction_ref_to_ref(t, node, &src_rdata,
2342                                                     &dest_rdata);
2343                 binder_debug(BINDER_DEBUG_TRANSACTION,
2344                              "        ref %d desc %d -> ref %d desc %d (node %d)\n",
2345                              src_rdata.debug_id, src_rdata.desc,
2346                              dest_rdata.debug_id, dest_rdata.desc,
2347                              node->debug_id);
2348         }
2349 done:
2350         binder_put_node(node);
2351         return ret;
2352 }
2353
2354 static int binder_translate_fd(int fd,
2355                                struct binder_transaction *t,
2356                                struct binder_thread *thread,
2357                                struct binder_transaction *in_reply_to)
2358 {
2359         struct binder_proc *proc = thread->proc;
2360         struct binder_proc *target_proc = t->to_proc;
2361         int target_fd;
2362         struct file *file;
2363         int ret;
2364         bool target_allows_fd;
2365
2366         if (in_reply_to)
2367                 target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
2368         else
2369                 target_allows_fd = t->buffer->target_node->accept_fds;
2370         if (!target_allows_fd) {
2371                 binder_user_error("%d:%d got %s with fd, %d, but target does not allow fds\n",
2372                                   proc->pid, thread->pid,
2373                                   in_reply_to ? "reply" : "transaction",
2374                                   fd);
2375                 ret = -EPERM;
2376                 goto err_fd_not_accepted;
2377         }
2378
2379         file = fget(fd);
2380         if (!file) {
2381                 binder_user_error("%d:%d got transaction with invalid fd, %d\n",
2382                                   proc->pid, thread->pid, fd);
2383                 ret = -EBADF;
2384                 goto err_fget;
2385         }
2386         ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file);
2387         if (ret < 0) {
2388                 ret = -EPERM;
2389                 goto err_security;
2390         }
2391
2392         target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
2393         if (target_fd < 0) {
2394                 ret = -ENOMEM;
2395                 goto err_get_unused_fd;
2396         }
2397         task_fd_install(target_proc, target_fd, file);
2398         trace_binder_transaction_fd(t, fd, target_fd);
2399         binder_debug(BINDER_DEBUG_TRANSACTION, "        fd %d -> %d\n",
2400                      fd, target_fd);
2401
2402         return target_fd;
2403
2404 err_get_unused_fd:
2405 err_security:
2406         fput(file);
2407 err_fget:
2408 err_fd_not_accepted:
2409         return ret;
2410 }
2411
2412 static int binder_translate_fd_array(struct binder_fd_array_object *fda,
2413                                      struct binder_buffer_object *parent,
2414                                      struct binder_transaction *t,
2415                                      struct binder_thread *thread,
2416                                      struct binder_transaction *in_reply_to)
2417 {
2418         binder_size_t fdi, fd_buf_size, num_installed_fds;
2419         int target_fd;
2420         uintptr_t parent_buffer;
2421         u32 *fd_array;
2422         struct binder_proc *proc = thread->proc;
2423         struct binder_proc *target_proc = t->to_proc;
2424
2425         fd_buf_size = sizeof(u32) * fda->num_fds;
2426         if (fda->num_fds >= SIZE_MAX / sizeof(u32)) {
2427                 binder_user_error("%d:%d got transaction with invalid number of fds (%lld)\n",
2428                                   proc->pid, thread->pid, (u64)fda->num_fds);
2429                 return -EINVAL;
2430         }
2431         if (fd_buf_size > parent->length ||
2432             fda->parent_offset > parent->length - fd_buf_size) {
2433                 /* No space for all file descriptors here. */
2434                 binder_user_error("%d:%d not enough space to store %lld fds in buffer\n",
2435                                   proc->pid, thread->pid, (u64)fda->num_fds);
2436                 return -EINVAL;
2437         }
2438         /*
2439          * Since the parent was already fixed up, convert it
2440          * back to the kernel address space to access it
2441          */
2442         parent_buffer = parent->buffer -
2443                 binder_alloc_get_user_buffer_offset(&target_proc->alloc);
2444         fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
2445         if (!IS_ALIGNED((unsigned long)fd_array, sizeof(u32))) {
2446                 binder_user_error("%d:%d parent offset not aligned correctly.\n",
2447                                   proc->pid, thread->pid);
2448                 return -EINVAL;
2449         }
2450         for (fdi = 0; fdi < fda->num_fds; fdi++) {
2451                 target_fd = binder_translate_fd(fd_array[fdi], t, thread,
2452                                                 in_reply_to);
2453                 if (target_fd < 0)
2454                         goto err_translate_fd_failed;
2455                 fd_array[fdi] = target_fd;
2456         }
2457         return 0;
2458
2459 err_translate_fd_failed:
2460         /*
2461          * Failed to allocate fd or security error, free fds
2462          * installed so far.
2463          */
2464         num_installed_fds = fdi;
2465         for (fdi = 0; fdi < num_installed_fds; fdi++)
2466                 task_close_fd(target_proc, fd_array[fdi]);
2467         return target_fd;
2468 }
2469
2470 static int binder_fixup_parent(struct binder_transaction *t,
2471                                struct binder_thread *thread,
2472                                struct binder_buffer_object *bp,
2473                                binder_size_t *off_start,
2474                                binder_size_t num_valid,
2475                                struct binder_buffer_object *last_fixup_obj,
2476                                binder_size_t last_fixup_min_off)
2477 {
2478         struct binder_buffer_object *parent;
2479         u8 *parent_buffer;
2480         struct binder_buffer *b = t->buffer;
2481         struct binder_proc *proc = thread->proc;
2482         struct binder_proc *target_proc = t->to_proc;
2483
2484         if (!(bp->flags & BINDER_BUFFER_FLAG_HAS_PARENT))
2485                 return 0;
2486
2487         parent = binder_validate_ptr(b, bp->parent, off_start, num_valid);
2488         if (!parent) {
2489                 binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
2490                                   proc->pid, thread->pid);
2491                 return -EINVAL;
2492         }
2493
2494         if (!binder_validate_fixup(b, off_start,
2495                                    parent, bp->parent_offset,
2496                                    last_fixup_obj,
2497                                    last_fixup_min_off)) {
2498                 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
2499                                   proc->pid, thread->pid);
2500                 return -EINVAL;
2501         }
2502
2503         if (parent->length < sizeof(binder_uintptr_t) ||
2504             bp->parent_offset > parent->length - sizeof(binder_uintptr_t)) {
2505                 /* No space for a pointer here! */
2506                 binder_user_error("%d:%d got transaction with invalid parent offset\n",
2507                                   proc->pid, thread->pid);
2508                 return -EINVAL;
2509         }
2510         parent_buffer = (u8 *)((uintptr_t)parent->buffer -
2511                         binder_alloc_get_user_buffer_offset(
2512                                 &target_proc->alloc));
2513         *(binder_uintptr_t *)(parent_buffer + bp->parent_offset) = bp->buffer;
2514
2515         return 0;
2516 }
2517
2518 /**
2519  * binder_proc_transaction() - sends a transaction to a process and wakes it up
2520  * @t:          transaction to send
2521  * @proc:       process to send the transaction to
2522  * @thread:     thread in @proc to send the transaction to (may be NULL)
2523  *
2524  * This function queues a transaction to the specified process. It will try
2525  * to find a thread in the target process to handle the transaction and
2526  * wake it up. If no thread is found, the work is queued to the proc
2527  * waitqueue.
2528  *
2529  * If the @thread parameter is not NULL, the transaction is always queued
2530  * to the waitlist of that specific thread.
2531  *
2532  * Return:      true if the transactions was successfully queued
2533  *              false if the target process or thread is dead
2534  */
2535 static bool binder_proc_transaction(struct binder_transaction *t,
2536                                     struct binder_proc *proc,
2537                                     struct binder_thread *thread)
2538 {
2539         struct list_head *target_list = NULL;
2540         struct binder_node *node = t->buffer->target_node;
2541         bool oneway = !!(t->flags & TF_ONE_WAY);
2542         bool wakeup = true;
2543
2544         BUG_ON(!node);
2545         binder_node_lock(node);
2546         if (oneway) {
2547                 BUG_ON(thread);
2548                 if (node->has_async_transaction) {
2549                         target_list = &node->async_todo;
2550                         wakeup = false;
2551                 } else {
2552                         node->has_async_transaction = 1;
2553                 }
2554         }
2555
2556         binder_inner_proc_lock(proc);
2557
2558         if (proc->is_dead || (thread && thread->is_dead)) {
2559                 binder_inner_proc_unlock(proc);
2560                 binder_node_unlock(node);
2561                 return false;
2562         }
2563
2564         if (!thread && !target_list)
2565                 thread = binder_select_thread_ilocked(proc);
2566
2567         if (thread)
2568                 target_list = &thread->todo;
2569         else if (!target_list)
2570                 target_list = &proc->todo;
2571         else
2572                 BUG_ON(target_list != &node->async_todo);
2573
2574         binder_enqueue_work_ilocked(&t->work, target_list);
2575
2576         if (wakeup)
2577                 binder_wakeup_thread_ilocked(proc, thread, !oneway /* sync */);
2578
2579         binder_inner_proc_unlock(proc);
2580         binder_node_unlock(node);
2581
2582         return true;
2583 }
2584
2585 /**
2586  * binder_get_node_refs_for_txn() - Get required refs on node for txn
2587  * @node:         struct binder_node for which to get refs
2588  * @proc:         returns @node->proc if valid
2589  * @error:        if no @proc then returns BR_DEAD_REPLY
2590  *
2591  * User-space normally keeps the node alive when creating a transaction
2592  * since it has a reference to the target. The local strong ref keeps it
2593  * alive if the sending process dies before the target process processes
2594  * the transaction. If the source process is malicious or has a reference
2595  * counting bug, relying on the local strong ref can fail.
2596  *
2597  * Since user-space can cause the local strong ref to go away, we also take
2598  * a tmpref on the node to ensure it survives while we are constructing
2599  * the transaction. We also need a tmpref on the proc while we are
2600  * constructing the transaction, so we take that here as well.
2601  *
2602  * Return: The target_node with refs taken or NULL if no @node->proc is NULL.
2603  * Also sets @proc if valid. If the @node->proc is NULL indicating that the
2604  * target proc has died, @error is set to BR_DEAD_REPLY
2605  */
2606 static struct binder_node *binder_get_node_refs_for_txn(
2607                 struct binder_node *node,
2608                 struct binder_proc **procp,
2609                 uint32_t *error)
2610 {
2611         struct binder_node *target_node = NULL;
2612
2613         binder_node_inner_lock(node);
2614         if (node->proc) {
2615                 target_node = node;
2616                 binder_inc_node_nilocked(node, 1, 0, NULL);
2617                 binder_inc_node_tmpref_ilocked(node);
2618                 node->proc->tmp_ref++;
2619                 *procp = node->proc;
2620         } else
2621                 *error = BR_DEAD_REPLY;
2622         binder_node_inner_unlock(node);
2623
2624         return target_node;
2625 }
2626
2627 static void binder_transaction(struct binder_proc *proc,
2628                                struct binder_thread *thread,
2629                                struct binder_transaction_data *tr, int reply,
2630                                binder_size_t extra_buffers_size)
2631 {
2632         int ret;
2633         struct binder_transaction *t;
2634         struct binder_work *tcomplete;
2635         binder_size_t *offp, *off_end, *off_start;
2636         binder_size_t off_min;
2637         u8 *sg_bufp, *sg_buf_end;
2638         struct binder_proc *target_proc = NULL;
2639         struct binder_thread *target_thread = NULL;
2640         struct binder_node *target_node = NULL;
2641         struct binder_transaction *in_reply_to = NULL;
2642         struct binder_transaction_log_entry *e;
2643         uint32_t return_error = 0;
2644         uint32_t return_error_param = 0;
2645         uint32_t return_error_line = 0;
2646         struct binder_buffer_object *last_fixup_obj = NULL;
2647         binder_size_t last_fixup_min_off = 0;
2648         struct binder_context *context = proc->context;
2649         int t_debug_id = atomic_inc_return(&binder_last_id);
2650
2651         e = binder_transaction_log_add(&binder_transaction_log);
2652         e->debug_id = t_debug_id;
2653         e->call_type = reply ? 2 : !!(tr->flags & TF_ONE_WAY);
2654         e->from_proc = proc->pid;
2655         e->from_thread = thread->pid;
2656         e->target_handle = tr->target.handle;
2657         e->data_size = tr->data_size;
2658         e->offsets_size = tr->offsets_size;
2659         e->context_name = proc->context->name;
2660
2661         if (reply) {
2662                 binder_inner_proc_lock(proc);
2663                 in_reply_to = thread->transaction_stack;
2664                 if (in_reply_to == NULL) {
2665                         binder_inner_proc_unlock(proc);
2666                         binder_user_error("%d:%d got reply transaction with no transaction stack\n",
2667                                           proc->pid, thread->pid);
2668                         return_error = BR_FAILED_REPLY;
2669                         return_error_param = -EPROTO;
2670                         return_error_line = __LINE__;
2671                         goto err_empty_call_stack;
2672                 }
2673                 if (in_reply_to->to_thread != thread) {
2674                         spin_lock(&in_reply_to->lock);
2675                         binder_user_error("%d:%d got reply transaction with bad transaction stack, transaction %d has target %d:%d\n",
2676                                 proc->pid, thread->pid, in_reply_to->debug_id,
2677                                 in_reply_to->to_proc ?
2678                                 in_reply_to->to_proc->pid : 0,
2679                                 in_reply_to->to_thread ?
2680                                 in_reply_to->to_thread->pid : 0);
2681                         spin_unlock(&in_reply_to->lock);
2682                         binder_inner_proc_unlock(proc);
2683                         return_error = BR_FAILED_REPLY;
2684                         return_error_param = -EPROTO;
2685                         return_error_line = __LINE__;
2686                         in_reply_to = NULL;
2687                         goto err_bad_call_stack;
2688                 }
2689                 thread->transaction_stack = in_reply_to->to_parent;
2690                 binder_inner_proc_unlock(proc);
2691                 binder_set_nice(in_reply_to->saved_priority);
2692                 target_thread = binder_get_txn_from_and_acq_inner(in_reply_to);
2693                 if (target_thread == NULL) {
2694                         return_error = BR_DEAD_REPLY;
2695                         return_error_line = __LINE__;
2696                         goto err_dead_binder;
2697                 }
2698                 if (target_thread->transaction_stack != in_reply_to) {
2699                         binder_user_error("%d:%d got reply transaction with bad target transaction stack %d, expected %d\n",
2700                                 proc->pid, thread->pid,
2701                                 target_thread->transaction_stack ?
2702                                 target_thread->transaction_stack->debug_id : 0,
2703                                 in_reply_to->debug_id);
2704                         binder_inner_proc_unlock(target_thread->proc);
2705                         return_error = BR_FAILED_REPLY;
2706                         return_error_param = -EPROTO;
2707                         return_error_line = __LINE__;
2708                         in_reply_to = NULL;
2709                         target_thread = NULL;
2710                         goto err_dead_binder;
2711                 }
2712                 target_proc = target_thread->proc;
2713                 target_proc->tmp_ref++;
2714                 binder_inner_proc_unlock(target_thread->proc);
2715         } else {
2716                 if (tr->target.handle) {
2717                         struct binder_ref *ref;
2718
2719                         /*
2720                          * There must already be a strong ref
2721                          * on this node. If so, do a strong
2722                          * increment on the node to ensure it
2723                          * stays alive until the transaction is
2724                          * done.
2725                          */
2726                         binder_proc_lock(proc);
2727                         ref = binder_get_ref_olocked(proc, tr->target.handle,
2728                                                      true);
2729                         if (ref) {
2730                                 target_node = binder_get_node_refs_for_txn(
2731                                                 ref->node, &target_proc,
2732                                                 &return_error);
2733                         } else {
2734                                 binder_user_error("%d:%d got transaction to invalid handle\n",
2735                                                   proc->pid, thread->pid);
2736                                 return_error = BR_FAILED_REPLY;
2737                         }
2738                         binder_proc_unlock(proc);
2739                 } else {
2740                         mutex_lock(&context->context_mgr_node_lock);
2741                         target_node = context->binder_context_mgr_node;
2742                         if (target_node)
2743                                 target_node = binder_get_node_refs_for_txn(
2744                                                 target_node, &target_proc,
2745                                                 &return_error);
2746                         else
2747                                 return_error = BR_DEAD_REPLY;
2748                         mutex_unlock(&context->context_mgr_node_lock);
2749                 }
2750                 if (!target_node) {
2751                         /*
2752                          * return_error is set above
2753                          */
2754                         return_error_param = -EINVAL;
2755                         return_error_line = __LINE__;
2756                         goto err_dead_binder;
2757                 }
2758                 e->to_node = target_node->debug_id;
2759                 if (security_binder_transaction(proc->tsk,
2760                                                 target_proc->tsk) < 0) {
2761                         return_error = BR_FAILED_REPLY;
2762                         return_error_param = -EPERM;
2763                         return_error_line = __LINE__;
2764                         goto err_invalid_target_handle;
2765                 }
2766                 binder_inner_proc_lock(proc);
2767                 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
2768                         struct binder_transaction *tmp;
2769
2770                         tmp = thread->transaction_stack;
2771                         if (tmp->to_thread != thread) {
2772                                 spin_lock(&tmp->lock);
2773                                 binder_user_error("%d:%d got new transaction with bad transaction stack, transaction %d has target %d:%d\n",
2774                                         proc->pid, thread->pid, tmp->debug_id,
2775                                         tmp->to_proc ? tmp->to_proc->pid : 0,
2776                                         tmp->to_thread ?
2777                                         tmp->to_thread->pid : 0);
2778                                 spin_unlock(&tmp->lock);
2779                                 binder_inner_proc_unlock(proc);
2780                                 return_error = BR_FAILED_REPLY;
2781                                 return_error_param = -EPROTO;
2782                                 return_error_line = __LINE__;
2783                                 goto err_bad_call_stack;
2784                         }
2785                         while (tmp) {
2786                                 struct binder_thread *from;
2787
2788                                 spin_lock(&tmp->lock);
2789                                 from = tmp->from;
2790                                 if (from && from->proc == target_proc) {
2791                                         atomic_inc(&from->tmp_ref);
2792                                         target_thread = from;
2793                                         spin_unlock(&tmp->lock);
2794                                         break;
2795                                 }
2796                                 spin_unlock(&tmp->lock);
2797                                 tmp = tmp->from_parent;
2798                         }
2799                 }
2800                 binder_inner_proc_unlock(proc);
2801         }
2802         if (target_thread)
2803                 e->to_thread = target_thread->pid;
2804         e->to_proc = target_proc->pid;
2805
2806         /* TODO: reuse incoming transaction for reply */
2807         t = kzalloc(sizeof(*t), GFP_KERNEL);
2808         if (t == NULL) {
2809                 return_error = BR_FAILED_REPLY;
2810                 return_error_param = -ENOMEM;
2811                 return_error_line = __LINE__;
2812                 goto err_alloc_t_failed;
2813         }
2814         binder_stats_created(BINDER_STAT_TRANSACTION);
2815         spin_lock_init(&t->lock);
2816
2817         tcomplete = kzalloc(sizeof(*tcomplete), GFP_KERNEL);
2818         if (tcomplete == NULL) {
2819                 return_error = BR_FAILED_REPLY;
2820                 return_error_param = -ENOMEM;
2821                 return_error_line = __LINE__;
2822                 goto err_alloc_tcomplete_failed;
2823         }
2824         binder_stats_created(BINDER_STAT_TRANSACTION_COMPLETE);
2825
2826         t->debug_id = t_debug_id;
2827
2828         if (reply)
2829                 binder_debug(BINDER_DEBUG_TRANSACTION,
2830                              "%d:%d BC_REPLY %d -> %d:%d, data %016llx-%016llx size %lld-%lld-%lld\n",
2831                              proc->pid, thread->pid, t->debug_id,
2832                              target_proc->pid, target_thread->pid,
2833                              (u64)tr->data.ptr.buffer,
2834                              (u64)tr->data.ptr.offsets,
2835                              (u64)tr->data_size, (u64)tr->offsets_size,
2836                              (u64)extra_buffers_size);
2837         else
2838                 binder_debug(BINDER_DEBUG_TRANSACTION,
2839                              "%d:%d BC_TRANSACTION %d -> %d - node %d, data %016llx-%016llx size %lld-%lld-%lld\n",
2840                              proc->pid, thread->pid, t->debug_id,
2841                              target_proc->pid, target_node->debug_id,
2842                              (u64)tr->data.ptr.buffer,
2843                              (u64)tr->data.ptr.offsets,
2844                              (u64)tr->data_size, (u64)tr->offsets_size,
2845                              (u64)extra_buffers_size);
2846
2847         if (!reply && !(tr->flags & TF_ONE_WAY))
2848                 t->from = thread;
2849         else
2850                 t->from = NULL;
2851         t->sender_euid = task_euid(proc->tsk);
2852         t->to_proc = target_proc;
2853         t->to_thread = target_thread;
2854         t->code = tr->code;
2855         t->flags = tr->flags;
2856         t->priority = task_nice(current);
2857
2858         trace_binder_transaction(reply, t, target_node);
2859
2860         t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size,
2861                 tr->offsets_size, extra_buffers_size,
2862                 !reply && (t->flags & TF_ONE_WAY));
2863         if (IS_ERR(t->buffer)) {
2864                 /*
2865                  * -ESRCH indicates VMA cleared. The target is dying.
2866                  */
2867                 return_error_param = PTR_ERR(t->buffer);
2868                 return_error = return_error_param == -ESRCH ?
2869                         BR_DEAD_REPLY : BR_FAILED_REPLY;
2870                 return_error_line = __LINE__;
2871                 t->buffer = NULL;
2872                 goto err_binder_alloc_buf_failed;
2873         }
2874         t->buffer->allow_user_free = 0;
2875         t->buffer->debug_id = t->debug_id;
2876         t->buffer->transaction = t;
2877         t->buffer->target_node = target_node;
2878         trace_binder_transaction_alloc_buf(t->buffer);
2879         off_start = (binder_size_t *)(t->buffer->data +
2880                                       ALIGN(tr->data_size, sizeof(void *)));
2881         offp = off_start;
2882
2883         if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
2884                            tr->data.ptr.buffer, tr->data_size)) {
2885                 binder_user_error("%d:%d got transaction with invalid data ptr\n",
2886                                 proc->pid, thread->pid);
2887                 return_error = BR_FAILED_REPLY;
2888                 return_error_param = -EFAULT;
2889                 return_error_line = __LINE__;
2890                 goto err_copy_data_failed;
2891         }
2892         if (copy_from_user(offp, (const void __user *)(uintptr_t)
2893                            tr->data.ptr.offsets, tr->offsets_size)) {
2894                 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
2895                                 proc->pid, thread->pid);
2896                 return_error = BR_FAILED_REPLY;
2897                 return_error_param = -EFAULT;
2898                 return_error_line = __LINE__;
2899                 goto err_copy_data_failed;
2900         }
2901         if (!IS_ALIGNED(tr->offsets_size, sizeof(binder_size_t))) {
2902                 binder_user_error("%d:%d got transaction with invalid offsets size, %lld\n",
2903                                 proc->pid, thread->pid, (u64)tr->offsets_size);
2904                 return_error = BR_FAILED_REPLY;
2905                 return_error_param = -EINVAL;
2906                 return_error_line = __LINE__;
2907                 goto err_bad_offset;
2908         }
2909         if (!IS_ALIGNED(extra_buffers_size, sizeof(u64))) {
2910                 binder_user_error("%d:%d got transaction with unaligned buffers size, %lld\n",
2911                                   proc->pid, thread->pid,
2912                                   (u64)extra_buffers_size);
2913                 return_error = BR_FAILED_REPLY;
2914                 return_error_param = -EINVAL;
2915                 return_error_line = __LINE__;
2916                 goto err_bad_offset;
2917         }
2918         off_end = (void *)off_start + tr->offsets_size;
2919         sg_bufp = (u8 *)(PTR_ALIGN(off_end, sizeof(void *)));
2920         sg_buf_end = sg_bufp + extra_buffers_size;
2921         off_min = 0;
2922         for (; offp < off_end; offp++) {
2923                 struct binder_object_header *hdr;
2924                 size_t object_size = binder_validate_object(t->buffer, *offp);
2925
2926                 if (object_size == 0 || *offp < off_min) {
2927                         binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
2928                                           proc->pid, thread->pid, (u64)*offp,
2929                                           (u64)off_min,
2930                                           (u64)t->buffer->data_size);
2931                         return_error = BR_FAILED_REPLY;
2932                         return_error_param = -EINVAL;
2933                         return_error_line = __LINE__;
2934                         goto err_bad_offset;
2935                 }
2936
2937                 hdr = (struct binder_object_header *)(t->buffer->data + *offp);
2938                 off_min = *offp + object_size;
2939                 switch (hdr->type) {
2940                 case BINDER_TYPE_BINDER:
2941                 case BINDER_TYPE_WEAK_BINDER: {
2942                         struct flat_binder_object *fp;
2943
2944                         fp = to_flat_binder_object(hdr);
2945                         ret = binder_translate_binder(fp, t, thread);
2946                         if (ret < 0) {
2947                                 return_error = BR_FAILED_REPLY;
2948                                 return_error_param = ret;
2949                                 return_error_line = __LINE__;
2950                                 goto err_translate_failed;
2951                         }
2952                 } break;
2953                 case BINDER_TYPE_HANDLE:
2954                 case BINDER_TYPE_WEAK_HANDLE: {
2955                         struct flat_binder_object *fp;
2956
2957                         fp = to_flat_binder_object(hdr);
2958                         ret = binder_translate_handle(fp, t, thread);
2959                         if (ret < 0) {
2960                                 return_error = BR_FAILED_REPLY;
2961                                 return_error_param = ret;
2962                                 return_error_line = __LINE__;
2963                                 goto err_translate_failed;
2964                         }
2965                 } break;
2966
2967                 case BINDER_TYPE_FD: {
2968                         struct binder_fd_object *fp = to_binder_fd_object(hdr);
2969                         int target_fd = binder_translate_fd(fp->fd, t, thread,
2970                                                             in_reply_to);
2971
2972                         if (target_fd < 0) {
2973                                 return_error = BR_FAILED_REPLY;
2974                                 return_error_param = target_fd;
2975                                 return_error_line = __LINE__;
2976                                 goto err_translate_failed;
2977                         }
2978                         fp->pad_binder = 0;
2979                         fp->fd = target_fd;
2980                 } break;
2981                 case BINDER_TYPE_FDA: {
2982                         struct binder_fd_array_object *fda =
2983                                 to_binder_fd_array_object(hdr);
2984                         struct binder_buffer_object *parent =
2985                                 binder_validate_ptr(t->buffer, fda->parent,
2986                                                     off_start,
2987                                                     offp - off_start);
2988                         if (!parent) {
2989                                 binder_user_error("%d:%d got transaction with invalid parent offset or type\n",
2990                                                   proc->pid, thread->pid);
2991                                 return_error = BR_FAILED_REPLY;
2992                                 return_error_param = -EINVAL;
2993                                 return_error_line = __LINE__;
2994                                 goto err_bad_parent;
2995                         }
2996                         if (!binder_validate_fixup(t->buffer, off_start,
2997                                                    parent, fda->parent_offset,
2998                                                    last_fixup_obj,
2999                                                    last_fixup_min_off)) {
3000                                 binder_user_error("%d:%d got transaction with out-of-order buffer fixup\n",
3001                                                   proc->pid, thread->pid);
3002                                 return_error = BR_FAILED_REPLY;
3003                                 return_error_param = -EINVAL;
3004                                 return_error_line = __LINE__;
3005                                 goto err_bad_parent;
3006                         }
3007                         ret = binder_translate_fd_array(fda, parent, t, thread,
3008                                                         in_reply_to);
3009                         if (ret < 0) {
3010                                 return_error = BR_FAILED_REPLY;
3011                                 return_error_param = ret;
3012                                 return_error_line = __LINE__;
3013                                 goto err_translate_failed;
3014                         }
3015                         last_fixup_obj = parent;
3016                         last_fixup_min_off =
3017                                 fda->parent_offset + sizeof(u32) * fda->num_fds;
3018                 } break;
3019                 case BINDER_TYPE_PTR: {
3020                         struct binder_buffer_object *bp =
3021                                 to_binder_buffer_object(hdr);
3022                         size_t buf_left = sg_buf_end - sg_bufp;
3023
3024                         if (bp->length > buf_left) {
3025                                 binder_user_error("%d:%d got transaction with too large buffer\n",
3026                                                   proc->pid, thread->pid);
3027                                 return_error = BR_FAILED_REPLY;
3028                                 return_error_param = -EINVAL;
3029                                 return_error_line = __LINE__;
3030                                 goto err_bad_offset;
3031                         }
3032                         if (copy_from_user(sg_bufp,
3033                                            (const void __user *)(uintptr_t)
3034                                            bp->buffer, bp->length)) {
3035                                 binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
3036                                                   proc->pid, thread->pid);
3037                                 return_error_param = -EFAULT;
3038                                 return_error = BR_FAILED_REPLY;
3039                                 return_error_line = __LINE__;
3040                                 goto err_copy_data_failed;
3041                         }
3042                         /* Fixup buffer pointer to target proc address space */
3043                         bp->buffer = (uintptr_t)sg_bufp +
3044                                 binder_alloc_get_user_buffer_offset(
3045                                                 &target_proc->alloc);
3046                         sg_bufp += ALIGN(bp->length, sizeof(u64));
3047
3048                         ret = binder_fixup_parent(t, thread, bp, off_start,
3049                                                   offp - off_start,
3050                                                   last_fixup_obj,
3051                                                   last_fixup_min_off);
3052                         if (ret < 0) {
3053                                 return_error = BR_FAILED_REPLY;
3054                                 return_error_param = ret;
3055                                 return_error_line = __LINE__;
3056                                 goto err_translate_failed;
3057                         }
3058                         last_fixup_obj = bp;
3059                         last_fixup_min_off = 0;
3060                 } break;
3061                 default:
3062                         binder_user_error("%d:%d got transaction with invalid object type, %x\n",
3063                                 proc->pid, thread->pid, hdr->type);
3064                         return_error = BR_FAILED_REPLY;
3065                         return_error_param = -EINVAL;
3066                         return_error_line = __LINE__;
3067                         goto err_bad_object_type;
3068                 }
3069         }
3070         tcomplete->type = B