BACKPORT: binder: add function to copy binder object from buffer

When creating or tearing down a transaction, the binder driver
examines objects in the buffer and takes appropriate action.
To do this without needing to dereference pointers into the
buffer, the local copies of the objects are needed. This patch
introduces a function to validate and copy binder objects
from the buffer to a local structure.

(cherry pick from commit 7a67a39320dfba4b36d3be5dae4581194e650316)
Bug: 67668716
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I42dfe238a2d20bdeff479068ca87a80e4577e64a

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index e91e26a325534ae98fa16026316805b8957b3f57..58b2420ae45a5f5e0a43d59404df178caf9aaead 100644 (file)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -663,6 +663,26 @@ struct binder_transaction {
        spinlock_t lock;
 };
 
+/**
+ * struct binder_object - union of flat binder object types
+ * @hdr:   generic object header
+ * @fbo:   binder object (nodes and refs)
+ * @fdo:   file descriptor object
+ * @bbo:   binder buffer pointer
+ * @fdao:  file descriptor array
+ *
+ * Used for type-independent object copies
+ */
+struct binder_object {
+       union {
+               struct binder_object_header hdr;
+               struct flat_binder_object fbo;
+               struct binder_fd_object fdo;
+               struct binder_buffer_object bbo;
+               struct binder_fd_array_object fdao;
+       };
+};
+
 /**
  * binder_proc_lock() - Acquire outer lock for given binder_proc
  * @proc:         struct binder_proc to acquire
@@ -2199,26 +2219,33 @@ static void binder_cleanup_transaction(struct binder_transaction *t,
 }
 
 /**
- * binder_validate_object() - checks for a valid metadata object in a buffer.
+ * binder_get_object() - gets object and checks for valid metadata
+ * @proc:      binder_proc owning the buffer
  * @buffer:    binder_buffer that we're parsing.
- * @offset:    offset in the buffer at which to validate an object.
+ * @offset:    offset in the @buffer at which to validate an object.
+ * @object:    struct binder_object to read into
  *
  * Return:     If there's a valid metadata object at @offset in @buffer, the
- *             size of that object. Otherwise, it returns zero.
+ *             size of that object. Otherwise, it returns zero. The object
+ *             is read into the struct binder_object pointed to by @object.
  */
-static size_t binder_validate_object(struct binder_buffer *buffer, u64 offset)
+static size_t binder_get_object(struct binder_proc *proc,
+                               struct binder_buffer *buffer,
+                               unsigned long offset,
+                               struct binder_object *object)
 {
-       /* Check if we can read a header first */
+       size_t read_size;
        struct binder_object_header *hdr;
        size_t object_size = 0;
 
-       if (buffer->data_size < sizeof(*hdr) ||
-           offset > buffer->data_size - sizeof(*hdr) ||
-           !IS_ALIGNED(offset, sizeof(u32)))
+       read_size = min_t(size_t, sizeof(*object), buffer->data_size - offset);
+       if (read_size < sizeof(*hdr))
                return 0;
+       binder_alloc_copy_from_buffer(&proc->alloc, object, buffer,
+                                     offset, read_size);
 
-       /* Ok, now see if we can read a complete object. */
-       hdr = (struct binder_object_header *)(buffer->data + offset);
+       /* Ok, now see if we read a complete object. */
+       hdr = &object->hdr;
        switch (hdr->type) {
        case BINDER_TYPE_BINDER:
        case BINDER_TYPE_WEAK_BINDER:
@@ -2369,6 +2396,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
        for (offp = off_start; offp < off_end; offp++) {
                struct binder_object_header *hdr;
                size_t object_size;
+               struct binder_object object;
                binder_size_t object_offset;
                binder_size_t buffer_offset = (uintptr_t)offp -
                        (uintptr_t)buffer->data;
@@ -2376,14 +2404,14 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                binder_alloc_copy_from_buffer(&proc->alloc, &object_offset,
                                              buffer, buffer_offset,
                                              sizeof(object_offset));
-               object_size = binder_validate_object(buffer, object_offset);
+               object_size = binder_get_object(proc, buffer,
+                                               object_offset, &object);
                if (object_size == 0) {
                        pr_err("transaction release %d bad object at offset %lld, size %zd\n",
                               debug_id, (u64)object_offset, buffer->data_size);
                        continue;
                }
-               hdr = (struct binder_object_header *)
-                       (buffer->data + object_offset);
+               hdr = &object.hdr;
                switch (hdr->type) {
                case BINDER_TYPE_BINDER:
                case BINDER_TYPE_WEAK_BINDER: {
@@ -3269,6 +3297,7 @@ static void binder_transaction(struct binder_proc *proc,
        for (; offp < off_end; offp++) {
                struct binder_object_header *hdr;
                size_t object_size;
+               struct binder_object object;
                binder_size_t object_offset;
                binder_size_t buffer_offset =
                        (uintptr_t)offp - (uintptr_t)t->buffer->data;
@@ -3278,7 +3307,8 @@ static void binder_transaction(struct binder_proc *proc,
                                              t->buffer,
                                              buffer_offset,
                                              sizeof(object_offset));
-               object_size = binder_validate_object(t->buffer, object_offset);
+               object_size = binder_get_object(target_proc, t->buffer,
+                                               object_offset, &object);
                if (object_size == 0 || object_offset < off_min) {
                        binder_user_error("%d:%d got transaction with invalid offset (%lld, min %lld max %lld) or object.\n",
                                          proc->pid, thread->pid,
@@ -3291,8 +3321,7 @@ static void binder_transaction(struct binder_proc *proc,
                        goto err_bad_offset;
                }
 
-               hdr = (struct binder_object_header *)
-                       (t->buffer->data + object_offset);
+               hdr = &object.hdr;
                off_min = object_offset + object_size;
                switch (hdr->type) {
                case BINDER_TYPE_BINDER:
@@ -3307,6 +3336,9 @@ static void binder_transaction(struct binder_proc *proc,
                                return_error_line = __LINE__;
                                goto err_translate_failed;
                        }
+                       binder_alloc_copy_to_buffer(&target_proc->alloc,
+                                                   t->buffer, object_offset,
+                                                   fp, sizeof(*fp));
                } break;
                case BINDER_TYPE_HANDLE:
                case BINDER_TYPE_WEAK_HANDLE: {
@@ -3320,6 +3352,9 @@ static void binder_transaction(struct binder_proc *proc,
                                return_error_line = __LINE__;
                                goto err_translate_failed;
                        }
+                       binder_alloc_copy_to_buffer(&target_proc->alloc,
+                                                   t->buffer, object_offset,
+                                                   fp, sizeof(*fp));
                } break;
 
                case BINDER_TYPE_FD: {
@@ -3335,6 +3370,9 @@ static void binder_transaction(struct binder_proc *proc,
                        }
                        fp->pad_binder = 0;
                        fp->fd = target_fd;
+                       binder_alloc_copy_to_buffer(&target_proc->alloc,
+                                                   t->buffer, object_offset,
+                                                   fp, sizeof(*fp));
                } break;
                case BINDER_TYPE_FDA: {
                        struct binder_fd_array_object *fda =
@@ -3419,7 +3457,10 @@ static void binder_transaction(struct binder_proc *proc,
                                return_error_line = __LINE__;
                                goto err_translate_failed;
                        }
-                       last_fixup_obj = bp;
+                       binder_alloc_copy_to_buffer(&target_proc->alloc,
+                                                   t->buffer, object_offset,
+                                                   bp, sizeof(*bp));
+                       last_fixup_obj = t->buffer->data + object_offset;
                        last_fixup_min_off = 0;
                } break;
                default: