Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 554c26cc authored by Nick Desaulniers's avatar Nick Desaulniers Committed by Dennis Cagle
Browse files

binder: blacklist %p kptr_restrict 

Bug: 31495231
Change-Id: Iebc150f6bc939b56e021424ee44fb30ce8d732fd
Git-repo: https://android.googlesource.com/kernel/msm


Git-commit: 0804d7840364fc1a93652632bd43a93c055c658e
Signed-off-by: default avatarDennis Cagle <d-cagle@codeaurora.org>
parent 6fe43690

drivers/staging/android/binder.c

+18 −18
Original line number Diff line number Diff line
@@ -473,7 +473,7 @@ static void binder_insert_free_buffer(struct binder_proc *proc, 
	new_buffer_size = binder_buffer_size(proc, new_buffer);



	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: add free buffer, size %zd, at %p\n",

		     "%d: add free buffer, size %zd, at %pK\n",

		      proc->pid, new_buffer_size, new_buffer);



	while (*p) {
@@ -551,7 +551,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, 
	struct mm_struct *mm;



	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: %s pages %p-%p\n", proc->pid,

		     "%d: %s pages %pK-%pK\n", proc->pid,

		     allocate ? "allocate" : "free", start, end);



	if (end <= start)
@@ -591,7 +591,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, 
		BUG_ON(*page);

		*page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);

		if (*page == NULL) {

			pr_err("%d: binder_alloc_buf failed for page at %p\n",

			pr_err("%d: binder_alloc_buf failed for page at %pK\n",

				proc->pid, page_addr);

			goto err_alloc_page_failed;

		}
@@ -600,7 +600,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, 
		flush_cache_vmap((unsigned long)page_addr,

				(unsigned long)page_addr + PAGE_SIZE);

		if (ret != 1) {

			pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",

			pr_err("%d: binder_alloc_buf failed to map page at %pK in kernel\n",

			       proc->pid, page_addr);

			goto err_map_kernel_failed;

		}
@@ -704,7 +704,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 
	}



	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",

		     "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",

		      proc->pid, size, buffer, buffer_size);



	has_page_addr =
@@ -734,7 +734,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc, 
		binder_insert_free_buffer(proc, new_buffer);

	}

	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_alloc_buf size %zd got %p\n",

		     "%d: binder_alloc_buf size %zd got %pK\n",

		      proc->pid, size, buffer);

	buffer->data_size = data_size;

	buffer->offsets_size = offsets_size;
@@ -774,7 +774,7 @@ static void binder_delete_free_buffer(struct binder_proc *proc, 
		if (buffer_end_page(prev) == buffer_end_page(buffer))

			free_page_end = 0;

		binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

			     "%d: merge free, buffer %p share page with %p\n",

			     "%d: merge free, buffer %pK share page with %pK\n",

			      proc->pid, buffer, prev);

	}
@@ -787,14 +787,14 @@ static void binder_delete_free_buffer(struct binder_proc *proc, 
			    buffer_start_page(buffer))

				free_page_start = 0;

			binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

				     "%d: merge free, buffer %p share page with %p\n",

				     "%d: merge free, buffer %pK share page with %pK\n",

				      proc->pid, buffer, prev);

		}

	}

	list_del(&buffer->entry);

	if (free_page_start || free_page_end) {

		binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

			     "%d: merge free, buffer %p do not share page%s%s with %p or %p\n",

			     "%d: merge free, buffer %pK do not share page%s%s with %pK or %pK\n",

			     proc->pid, buffer, free_page_start ? "" : " end",

			     free_page_end ? "" : " start", prev, next);

		binder_update_page_range(proc, 0, free_page_start ?
@@ -815,7 +815,7 @@ static void binder_free_buf(struct binder_proc *proc, 
		ALIGN(buffer->offsets_size, sizeof(void *));



	binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_free_buf %p size %zd buffer_size %zd\n",

		     "%d: binder_free_buf %pK size %zd buffer_size %zd\n",

		      proc->pid, buffer, size, buffer_size);



	BUG_ON(buffer->free);
@@ -1245,7 +1245,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, 
	int debug_id = buffer->debug_id;



	binder_debug(BINDER_DEBUG_TRANSACTION,

		     "%d buffer release %d, size %zd-%zd, failed at %p\n",

		     "%d buffer release %d, size %zd-%zd, failed at %pK\n",

		     proc->pid, buffer->debug_id,

		     buffer->data_size, buffer->offsets_size, failed_at);
@@ -2100,7 +2100,7 @@ static int binder_thread_write(struct binder_proc *proc, 
				}

			}

			binder_debug(BINDER_DEBUG_DEAD_BINDER,

				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",

				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",

				     proc->pid, thread->pid, (u64)cookie,

				     death);

			if (death == NULL) {
@@ -2903,7 +2903,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 
#ifdef CONFIG_CPU_CACHE_VIPT

	if (cache_is_vipt_aliasing()) {

		while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) {

			pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);

			pr_info("binder_mmap: %d %lx-%lx maps %pK bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);

			vma->vm_start += PAGE_SIZE;

		}

	}
@@ -2935,7 +2935,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) 
	proc->vma = vma;

	proc->vma_vm_mm = vma->vm_mm;



	/*pr_info("binder_mmap: %d %lx-%lx maps %p\n",

	/*pr_info("binder_mmap: %d %lx-%lx maps %pK\n",

		 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/

	return 0;
@@ -3161,7 +3161,7 @@ static void binder_deferred_release(struct binder_proc *proc) 


			page_addr = proc->buffer + i * PAGE_SIZE;

			binder_debug(BINDER_DEBUG_BUFFER_ALLOC,

				     "%s: %d: page %d at %p not freed\n",

				     "%s: %d: page %d at %pK not freed\n",

				     __func__, proc->pid, i, page_addr);

			unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);

			__free_page(proc->pages[i]);
@@ -3240,7 +3240,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix, 
				     struct binder_transaction *t)

{

	seq_printf(m,

		   "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",

		   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",

		   prefix, t->debug_id, t,

		   t->from ? t->from->proc->pid : 0,

		   t->from ? t->from->pid : 0,
@@ -3254,7 +3254,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix, 
	if (t->buffer->target_node)

		seq_printf(m, " node %d",

			   t->buffer->target_node->debug_id);

	seq_printf(m, " size %zd:%zd data %p\n",

	seq_printf(m, " size %zd:%zd data %pK\n",

		   t->buffer->data_size, t->buffer->offsets_size,

		   t->buffer->data);

}
@@ -3262,7 +3262,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix, 
static void print_binder_buffer(struct seq_file *m, const char *prefix,

				struct binder_buffer *buffer)

{

	seq_printf(m, "%s %d: %p size %zd:%zd %s\n",

	seq_printf(m, "%s %d: %pK size %zd:%zd %s\n",

		   prefix, buffer->debug_id, buffer->data,

		   buffer->data_size, buffer->offsets_size,

		   buffer->transaction ? "active" : "delivered");