lkml.org 
[lkml]   [2019]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/7] binder: create userspace-to-binder-buffer copy function
    Date
    The binder driver uses a vm_area to map the per-process
    binder buffer space. For 32-bit android devices, this is
    now taking too much vmalloc space. This patch removes
    the use of vm_area when copying the transaction data
    from the sender to the buffer space. Instead of using
    copy_from_user() for multi-page copies, it now uses
    binder_alloc_copy_user_to_buffer() which uses kmap()
    and kunmap() to map each page, and uses copy_from_user()
    for copying to that page.

    Signed-off-by: Todd Kjos <tkjos@google.com>
    ---
    drivers/android/binder.c | 29 +++++++--
    drivers/android/binder_alloc.c | 114 +++++++++++++++++++++++++++++++++
    drivers/android/binder_alloc.h | 8 +++
    3 files changed, 144 insertions(+), 7 deletions(-)

    diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    index 5f6ef5e63b91e..ab0b3eec363bc 100644
    --- a/drivers/android/binder.c
    +++ b/drivers/android/binder.c
    @@ -3078,8 +3078,12 @@ static void binder_transaction(struct binder_proc *proc,
    ALIGN(tr->data_size, sizeof(void *)));
    offp = off_start;

    - if (copy_from_user(t->buffer->data, (const void __user *)(uintptr_t)
    - tr->data.ptr.buffer, tr->data_size)) {
    + if (binder_alloc_copy_user_to_buffer(
    + &target_proc->alloc,
    + t->buffer, 0,
    + (const void __user *)
    + (uintptr_t)tr->data.ptr.buffer,
    + tr->data_size)) {
    binder_user_error("%d:%d got transaction with invalid data ptr\n",
    proc->pid, thread->pid);
    return_error = BR_FAILED_REPLY;
    @@ -3087,8 +3091,13 @@ static void binder_transaction(struct binder_proc *proc,
    return_error_line = __LINE__;
    goto err_copy_data_failed;
    }
    - if (copy_from_user(offp, (const void __user *)(uintptr_t)
    - tr->data.ptr.offsets, tr->offsets_size)) {
    + if (binder_alloc_copy_user_to_buffer(
    + &target_proc->alloc,
    + t->buffer,
    + ALIGN(tr->data_size, sizeof(void *)),
    + (const void __user *)
    + (uintptr_t)tr->data.ptr.offsets,
    + tr->offsets_size)) {
    binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
    proc->pid, thread->pid);
    return_error = BR_FAILED_REPLY;
    @@ -3217,6 +3226,8 @@ static void binder_transaction(struct binder_proc *proc,
    struct binder_buffer_object *bp =
    to_binder_buffer_object(hdr);
    size_t buf_left = sg_buf_end - sg_bufp;
    + binder_size_t sg_buf_offset = (uintptr_t)sg_bufp -
    + (uintptr_t)t->buffer->data;

    if (bp->length > buf_left) {
    binder_user_error("%d:%d got transaction with too large buffer\n",
    @@ -3226,9 +3237,13 @@ static void binder_transaction(struct binder_proc *proc,
    return_error_line = __LINE__;
    goto err_bad_offset;
    }
    - if (copy_from_user(sg_bufp,
    - (const void __user *)(uintptr_t)
    - bp->buffer, bp->length)) {
    + if (binder_alloc_copy_user_to_buffer(
    + &target_proc->alloc,
    + t->buffer,
    + sg_buf_offset,
    + (const void __user *)
    + (uintptr_t)bp->buffer,
    + bp->length)) {
    binder_user_error("%d:%d got transaction with invalid offsets ptr\n",
    proc->pid, thread->pid);
    return_error_param = -EFAULT;
    diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
    index 022cd80e80cc3..255fa71911e5e 100644
    --- a/drivers/android/binder_alloc.c
    +++ b/drivers/android/binder_alloc.c
    @@ -29,6 +29,8 @@
    #include <linux/list_lru.h>
    #include <linux/ratelimit.h>
    #include <asm/cacheflush.h>
    +#include <linux/uaccess.h>
    +#include <linux/highmem.h>
    #include "binder_alloc.h"
    #include "binder_trace.h"

    @@ -1053,3 +1055,115 @@ int binder_alloc_shrinker_init(void)
    }
    return ret;
    }
    +
    +/**
    + * check_buffer() - verify that buffer/offset is safe to access
    + * @alloc: binder_alloc for this proc
    + * @buffer: binder buffer to be accessed
    + * @offset: offset into @buffer data
    + * @bytes: bytes to access from offset
    + *
    + * Check that the @offset/@bytes are within the size of the given
    + * @buffer and that the buffer is currently active and not freeable.
    + * Offsets must also be multiples of sizeof(u32). The kernel is
    + * allowed to touch the buffer in two cases:
    + *
    + * 1) when the buffer is being created:
    + * (buffer->free == 0 && buffer->allow_user_free == 0)
    + * 2) when the buffer is being torn down:
    + * (buffer->free == 0 && buffer->transaction == NULL).
    + *
    + * Return: true if the buffer is safe to access
    + */
    +static inline bool check_buffer(struct binder_alloc *alloc,
    + struct binder_buffer *buffer,
    + binder_size_t offset, size_t bytes)
    +{
    + size_t buffer_size = binder_alloc_buffer_size(alloc, buffer);
    +
    + return buffer_size >= bytes &&
    + offset <= buffer_size - bytes &&
    + IS_ALIGNED(offset, sizeof(u32)) &&
    + !buffer->free &&
    + (!buffer->allow_user_free || !buffer->transaction);
    +}
    +
    +/**
    + * binder_alloc_get_page() - get kernel pointer for given buffer offset
    + * @alloc: binder_alloc for this proc
    + * @buffer: binder buffer to be accessed
    + * @buffer_offset: offset into @buffer data
    + * @pgoffp: address to copy final page offset to
    + *
    + * Lookup the struct page corresponding to the address
    + * at @buffer_offset into @buffer->data. If @pgoffp is not
    + * NULL, the byte-offset into the page is written there.
    + *
    + * The caller is responsible to ensure that the offset points
    + * to a valid address within the @buffer and that @buffer is
    + * not freeable by the user. Since it can't be freed, we are
    + * guaranteed that the corresponding elements of @alloc->pages[]
    + * cannot change.
    + *
    + * Return: struct page
    + */
    +static struct page *binder_alloc_get_page(struct binder_alloc *alloc,
    + struct binder_buffer *buffer,
    + binder_size_t buffer_offset,
    + pgoff_t *pgoffp)
    +{
    + binder_size_t buffer_space_offset = buffer_offset +
    + ((uintptr_t)buffer->data - (uintptr_t)alloc->buffer);
    + pgoff_t pgoff = buffer_space_offset & ~PAGE_MASK;
    + size_t index = buffer_space_offset >> PAGE_SHIFT;
    + struct binder_lru_page *lru_page;
    +
    + lru_page = &alloc->pages[index];
    + *pgoffp = pgoff;
    + return lru_page->page_ptr;
    +}
    +
    +/**
    + * binder_alloc_copy_user_to_buffer() - copy src user to tgt user
    + * @alloc: binder_alloc for this proc
    + * @buffer: binder buffer to be accessed
    + * @buffer_offset: offset into @buffer data
    + * @from: userspace pointer to source buffer
    + * @bytes: bytes to copy
    + *
    + * Copy bytes from source userspace to target buffer.
    + *
    + * Return: bytes remaining to be copied
    + */
    +unsigned long
    +binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
    + struct binder_buffer *buffer,
    + binder_size_t buffer_offset,
    + const void __user *from,
    + size_t bytes)
    +{
    + if (!check_buffer(alloc, buffer, buffer_offset, bytes))
    + return bytes;
    +
    + while (bytes) {
    + unsigned long size;
    + unsigned long ret;
    + struct page *page;
    + pgoff_t pgoff;
    + void *kptr;
    +
    + page = binder_alloc_get_page(alloc, buffer,
    + buffer_offset, &pgoff);
    + size = min(bytes, (size_t)(PAGE_SIZE - pgoff));
    + kptr = (void *)((uintptr_t)kmap(page) + pgoff);
    + ret = copy_from_user(kptr, (const void __user *)(uintptr_t)from,
    + size);
    + kunmap(page);
    + if (ret)
    + return bytes - size + ret;
    + bytes -= size;
    + from = (void __user *)(uintptr_t)from + size;
    + buffer_offset += size;
    + }
    + return 0;
    +}
    diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
    index c0aadbbf7f193..995155f31dbd4 100644
    --- a/drivers/android/binder_alloc.h
    +++ b/drivers/android/binder_alloc.h
    @@ -22,6 +22,7 @@
    #include <linux/vmalloc.h>
    #include <linux/slab.h>
    #include <linux/list_lru.h>
    +#include <uapi/linux/android/binder.h>

    extern struct list_lru binder_alloc_lru;
    struct binder_transaction;
    @@ -183,5 +184,12 @@ binder_alloc_get_user_buffer_offset(struct binder_alloc *alloc)
    return alloc->user_buffer_offset;
    }

    +unsigned long
    +binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
    + struct binder_buffer *buffer,
    + binder_size_t buffer_offset,
    + const void __user *from,
    + size_t bytes);
    +
    #endif /* _LINUX_BINDER_ALLOC_H */

    --
    2.20.1.495.gaa96b0ce6b-goog
    \
     
     \ /
      Last update: 2019-01-29 01:50    [W:6.472 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site