Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f409272 authored by Todd Kjos's avatar Todd Kjos Committed by Bernhard Thoben
Browse files

UPSTREAM: binder: add flag to clear buffer on txn complete 



Add a per-transaction flag to indicate that the buffer
must be cleared when the transaction is complete to
prevent copies of sensitive data from being preserved
in memory.

Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20201120233743.3617529-1-tkjos@google.com


Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 171501513
Change-Id: Ic9338c85cbe3b11ab6f2bda55dce9964bb48447a
(cherry picked from commit 0f966cba95c78029f491b433ea95ff38f414a761)
Signed-off-by: default avatarTodd Kjos <tkjos@google.com>
(cherry picked from commit 92b2ec21896a13b5aca1425dca1bd9a1df705cd0)
parent 5866d2f8

drivers/android/binder.c

+1 −0
Original line number Diff line number Diff line
@@ -3251,6 +3251,7 @@ static void binder_transaction(struct binder_proc *proc, 
	t->buffer->debug_id = t->debug_id;

	t->buffer->transaction = t;

	t->buffer->target_node = target_node;

	t->buffer->clear_on_free = !!(t->flags & TF_CLEAR_BUF);

	trace_binder_transaction_alloc_buf(t->buffer);

	off_start = (binder_size_t *)(t->buffer->data +

				      ALIGN(tr->data_size, sizeof(void *)));

drivers/android/binder_alloc.c

+48 −0
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ 
#include <linux/vmalloc.h>

#include <linux/slab.h>

#include <linux/sched.h>

#include <linux/highmem.h>

#include <linux/sizes.h>

#include "binder_alloc.h"

#include "binder_trace.h"
@@ -640,6 +641,8 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, 
	binder_insert_free_buffer(alloc, buffer);

}



static void binder_alloc_clear_buf(struct binder_alloc *alloc,

				   struct binder_buffer *buffer);

/**

 * binder_alloc_free_buf() - free a binder buffer

 * @alloc:	binder_alloc for this proc
@@ -650,6 +653,18 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, 
void binder_alloc_free_buf(struct binder_alloc *alloc,

			    struct binder_buffer *buffer)

{

	/*

	 * We could eliminate the call to binder_alloc_clear_buf()

	 * from binder_alloc_deferred_release() by moving this to

	 * binder_alloc_free_buf_locked(). However, that could

	 * increase contention for the alloc mutex if clear_on_free

	 * is used frequently for large buffers. The mutex is not

	 * needed for correctness here.

	 */

	if (buffer->clear_on_free) {

		binder_alloc_clear_buf(alloc, buffer);

		buffer->clear_on_free = false;

	}

	mutex_lock(&alloc->mutex);

	binder_free_buf_locked(alloc, buffer);

	mutex_unlock(&alloc->mutex);
@@ -757,6 +772,10 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc) 
		/* Transaction should already have been freed */

		BUG_ON(buffer->transaction);



		if (buffer->clear_on_free) {

			binder_alloc_clear_buf(alloc, buffer);

			buffer->clear_on_free = false;

		}

		binder_free_buf_locked(alloc, buffer);

		buffers++;

	}
@@ -877,3 +896,32 @@ void binder_alloc_init(struct binder_alloc *alloc) 
	INIT_LIST_HEAD(&alloc->buffers);

}



/**

 * binder_alloc_clear_buf() - zero out buffer

 * @alloc: binder_alloc for this proc

 * @buffer: binder buffer to be cleared

 *

 * memset the given buffer to 0

 */

static void binder_alloc_clear_buf(struct binder_alloc *alloc,

				   struct binder_buffer *buffer)

{

	size_t bytes = binder_alloc_buffer_size(alloc, buffer);

	binder_size_t buffer_offset = 0;



	while (bytes) {

		unsigned long size;

		struct page *page;

		pgoff_t pgoff;

		void *kptr;



		page = binder_alloc_get_page(alloc, buffer,

					     buffer_offset, &pgoff);

		size = min_t(size_t, bytes, PAGE_SIZE - pgoff);

		kptr = kmap(page) + pgoff;

		memset(kptr, 0, size);

		kunmap(page);

		bytes -= size;

		buffer_offset += size;

	}

}

drivers/android/binder_alloc.h

+3 −1
Original line number Diff line number Diff line
@@ -29,6 +29,7 @@ struct binder_transaction; 
 * @entry:              entry alloc->buffers

 * @rb_node:            node for allocated_buffers/free_buffers rb trees

 * @free:               %true if buffer is free

 * @clear_on_free:      %true if buffer must be zeroed after use

 * @allow_user_free:    %true if user is allowed to free buffer

 * @async_transaction:  %true if buffer is in use for an async txn

 * @debug_id:           unique ID for debugging
@@ -47,9 +48,10 @@ struct binder_buffer { 
	struct rb_node rb_node; /* free entry by size or allocated entry */

				/* by address */

	unsigned free:1;

	unsigned clear_on_free:1;

	unsigned allow_user_free:1;

	unsigned async_transaction:1;

	unsigned debug_id:29;

	unsigned debug_id:28;



	struct binder_transaction *transaction;

include/uapi/linux/android/binder.h

+1 −0
Original line number Diff line number Diff line
@@ -309,6 +309,7 @@ enum transaction_flags { 
	TF_ROOT_OBJECT	= 0x04,	/* contents are the component's root object */

	TF_STATUS_CODE	= 0x08,	/* contents are a 32-bit status code */

	TF_ACCEPT_FDS	= 0x10,	/* allow replies with file descriptors */

	TF_CLEAR_BUF	= 0x20,	/* clear buffer on txn complete */

};



struct binder_transaction_data {