import PULS_20180308

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / staging / android / binder.c

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 78c87d5a6adfa65b249b067636e77d40025185fa..b27287ebc0393c7ce2ff921eecfa2df38b0c626b 100644 (file)
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -1486,7 +1486,7 @@ static void binder_insert_free_buffer(struct binder_proc *proc,
        new_buffer_size = binder_buffer_size(proc, new_buffer);
 
        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                    "%d: add free buffer, size %zd, at %p\n",
+                    "%d: add free buffer, size %zd, at %pK\n",
                      proc->pid, new_buffer_size, new_buffer);
 
        while (*p) {
@@ -1565,7 +1565,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
        struct mm_struct *mm;
 
        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                    "%d: %s pages %p-%p\n", proc->pid,
+                    "%d: %s pages %pK-%pK\n", proc->pid,
                     allocate ? "allocate" : "free", start, end);
 
        if (end <= start)
@@ -1605,7 +1605,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
                BUG_ON(*page);
                *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
                if (*page == NULL) {
-                       pr_err("%d: binder_alloc_buf failed for page at %p\n",
+                       pr_err("%d: binder_alloc_buf failed for page at %pK\n",
                                proc->pid, page_addr);
                        goto err_alloc_page_failed;
                }
@@ -1622,7 +1622,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
                page_array_ptr = page;
                ret = map_vm_area(&tmp_area, PAGE_KERNEL, &page_array_ptr);
                if (ret) {
-                       pr_err("%d: binder_alloc_buf failed to map page at %p in kernel\n",
+                       pr_err("%d: binder_alloc_buf failed to map page at %pK in kernel\n",
                               proc->pid, page_addr);
                        goto err_map_kernel_failed;
                }
@@ -1768,7 +1768,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,
        }
 
        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                    "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
+                    "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",
                      proc->pid, size, buffer, buffer_size);
 
        has_page_addr =
@@ -1797,7 +1797,7 @@ static struct binder_buffer *binder_alloc_buf(struct binder_proc *proc,
                binder_insert_free_buffer(proc, new_buffer);
        }
        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                    "%d: binder_alloc_buf size %zd got %p\n",
+                    "%d: binder_alloc_buf size %zd got %pK\n",
                      proc->pid, size, buffer);
        buffer->data_size = data_size;
        buffer->offsets_size = offsets_size;
@@ -1837,7 +1837,7 @@ static void binder_delete_free_buffer(struct binder_proc *proc,
                if (buffer_end_page(prev) == buffer_end_page(buffer))
                        free_page_end = 0;
                binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                            "%d: merge free, buffer %p share page with %p\n",
+                            "%d: merge free, buffer %pK share page with %pK\n",
                              proc->pid, buffer, prev);
        }
 
@@ -1850,14 +1850,14 @@ static void binder_delete_free_buffer(struct binder_proc *proc,
                            buffer_start_page(buffer))
                                free_page_start = 0;
                        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                                    "%d: merge free, buffer %p share page with %p\n",
+                                    "%d: merge free, buffer %pK share page with %pK\n",
                                      proc->pid, buffer, prev);
                }
        }
        list_del(&buffer->entry);
        if (free_page_start || free_page_end) {
                binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                            "%d: merge free, buffer %p do not share page%s%s with %p or %p\n",
+                            "%d: merge free, buffer %pK do not share page%s%s with %pK or %pK\n",
                             proc->pid, buffer, free_page_start ? "" : " end",
                             free_page_end ? "" : " start", prev, next);
                binder_update_page_range(proc, 0, free_page_start ?
@@ -1878,7 +1878,7 @@ static void binder_free_buf(struct binder_proc *proc,
                ALIGN(buffer->offsets_size, sizeof(void *));
 
        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                    "%d: binder_free_buf %p size %zd buffer_size %zd\n",
+                    "%d: binder_free_buf %pK size %zd buffer_size %zd\n",
                      proc->pid, buffer, size, buffer_size);
 
        BUG_ON(buffer->free);
@@ -2063,7 +2063,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
 
 
 static struct binder_ref *binder_get_ref(struct binder_proc *proc,
-                                        uint32_t desc)
+                                        uint32_t desc, bool need_strong_ref)
 {
        struct rb_node *n = proc->refs_by_desc.rb_node;
        struct binder_ref *ref;
@@ -2071,12 +2071,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
        while (n) {
                ref = rb_entry(n, struct binder_ref, rb_node_desc);
 
-               if (desc < ref->desc)
+               if (desc < ref->desc) {
                        n = n->rb_left;
-               else if (desc > ref->desc)
+               } else if (desc > ref->desc) {
                        n = n->rb_right;
-               else
+               } else if (need_strong_ref && !ref->strong) {
+                       binder_user_error("tried to use weak ref as strong ref\n");
+                       return NULL;
+               } else {
                        return ref;
+               }
        }
        return NULL;
 }
@@ -2304,7 +2308,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
        int debug_id = buffer->debug_id;
 
        binder_debug(BINDER_DEBUG_TRANSACTION,
-                    "%d buffer release %d, size %zd-%zd, failed at %p\n",
+                    "%d buffer release %d, size %zd-%zd, failed at %pK\n",
                     proc->pid, buffer->debug_id,
                     buffer->data_size, buffer->offsets_size, failed_at);
 
@@ -2343,7 +2347,8 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                } break;
                case BINDER_TYPE_HANDLE:
                case BINDER_TYPE_WEAK_HANDLE: {
-                       struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+                       struct binder_ref *ref = binder_get_ref(proc, fp->handle,
+                                               fp->type == BINDER_TYPE_HANDLE);
                        if (ref == NULL) {
                                pr_err("transaction release %d bad handle %d\n",
                                 debug_id, fp->handle);
@@ -2559,7 +2564,7 @@ static void binder_transaction(struct binder_proc *proc,
        } else {
                if (tr->target.handle) {
                        struct binder_ref *ref;
-                       ref = binder_get_ref(proc, tr->target.handle);
+                       ref = binder_get_ref(proc, tr->target.handle, true);
                        if (ref == NULL) {
                                binder_user_error("%d:%d got transaction to invalid handle\n",
                                        proc->pid, thread->pid);
@@ -2904,7 +2909,9 @@ out_err:
                                fp->type = BINDER_TYPE_HANDLE;
                        else
                                fp->type = BINDER_TYPE_WEAK_HANDLE;
+                       fp->binder = 0;
                        fp->handle = ref->desc;
+                       fp->cookie = 0;
                        binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
                                       &thread->todo);
 
@@ -2916,7 +2923,8 @@ out_err:
                } break;
                case BINDER_TYPE_HANDLE:
                case BINDER_TYPE_WEAK_HANDLE: {
-                       struct binder_ref *ref = binder_get_ref(proc, fp->handle);
+                       struct binder_ref *ref = binder_get_ref(proc, fp->handle,
+                                               fp->type == BINDER_TYPE_HANDLE);
                        if (ref == NULL) {
                                binder_user_error("%d:%d got transaction with invalid handle, %d\n",
                                                proc->pid,
@@ -2952,7 +2960,9 @@ out_err:
                                        return_error = BR_FAILED_REPLY;
                                        goto err_binder_get_ref_for_node_failed;
                                }
+                               fp->binder = 0;
                                fp->handle = new_ref->desc;
+                               fp->cookie = 0;
                                binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
                                trace_binder_transaction_ref_to_ref(t, ref,
                                                                    new_ref);
@@ -3011,6 +3021,7 @@ out_err:
                        binder_debug(BINDER_DEBUG_TRANSACTION,
                                     "        fd %d -> %d\n", fp->handle, target_fd);
                        /* TODO: fput? */
+                       fp->binder = 0;
                        fp->handle = target_fd;
 #ifdef BINDER_MONITOR
                        e->fd = target_fd;
@@ -3199,7 +3210,9 @@ int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
                                                ref->desc);
                                }
                        } else
-                               ref = binder_get_ref(proc, target);
+                               ref = binder_get_ref(proc, target,
+                                               cmd == BC_ACQUIRE ||
+                                               cmd == BC_RELEASE);
                        if (ref == NULL) {
                                binder_user_error("%d:%d refcount change on invalid ref %d\n",
                                        proc->pid, thread->pid, target);
@@ -3408,7 +3421,7 @@ int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
                        if (get_user(cookie, (binder_uintptr_t __user *)ptr))
                                return -EFAULT;
                        ptr += sizeof(binder_uintptr_t);
-                       ref = binder_get_ref(proc, target);
+                       ref = binder_get_ref(proc, target, false);
                        if (ref == NULL) {
                                binder_user_error("%d:%d %s invalid ref %d\n",
                                        proc->pid, thread->pid,
@@ -3520,7 +3533,7 @@ int binder_thread_write(struct binder_proc *proc, struct binder_thread *thread,
                                }
                        }
                        binder_debug(BINDER_DEBUG_DEAD_BINDER,
-                                    "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
+                                    "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
                                     proc->pid, thread->pid, (u64)cookie, death);
                        if (death == NULL) {
                                binder_user_error("%d:%d BC_DEAD_BINDER_DONE %016llx not found\n",
@@ -4431,7 +4444,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
 #ifdef CONFIG_CPU_CACHE_VIPT
        if (cache_is_vipt_aliasing()) {
                while (CACHE_COLOUR((vma->vm_start ^ (uint32_t)proc->buffer))) {
-                       pr_info("binder_mmap: %d %lx-%lx maps %p bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
+                       pr_info("binder_mmap: %d %lx-%lx maps %pK bad alignment\n", proc->pid, vma->vm_start, vma->vm_end, proc->buffer);
                        vma->vm_start += PAGE_SIZE;
                }
        }
@@ -4463,7 +4476,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
        proc->vma = vma;
        proc->vma_vm_mm = vma->vm_mm;
 
-       /*pr_info("binder_mmap: %d %lx-%lx maps %p\n",
+       /*pr_info("binder_mmap: %d %lx-%lx maps %pK\n",
                 proc->pid, vma->vm_start, vma->vm_end, proc->buffer);*/
        return 0;
 
@@ -4747,7 +4760,7 @@ static void binder_deferred_release(struct binder_proc *proc)
 
                        page_addr = proc->buffer + i * PAGE_SIZE;
                        binder_debug(BINDER_DEBUG_BUFFER_ALLOC,
-                                    "%s: %d: page %d at %p not freed\n",
+                                    "%s: %d: page %d at %pK not freed\n",
                                     __func__, proc->pid, i, page_addr);
                        unmap_kernel_range((unsigned long)page_addr, PAGE_SIZE);
                        __free_page(proc->pages[i]);
@@ -4848,7 +4861,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix,
        rtc_time_to_tm(t->tv.tv_sec, &tm);
 #endif
        seq_printf(m,
-                  "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
+                  "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
                   prefix, t->debug_id, t,
                   t->from ? t->from->proc->pid : 0,
                   t->from ? t->from->pid : 0,
@@ -4873,7 +4886,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix,
                seq_printf(m, " node %d",
                           t->buffer->target_node->debug_id);
 #ifdef BINDER_MONITOR
-       seq_printf(m, " size %zd:%zd data %p auf %d start %lu.%06lu"
+       seq_printf(m, " size %zd:%zd data %pK auf %d start %lu.%06lu"
                   " android %d-%02d-%02d %02d:%02d:%02d.%03lu\n",
                   t->buffer->data_size, t->buffer->offsets_size,
                   t->buffer->data, t->buffer->allow_user_free,
@@ -4892,7 +4905,7 @@ static void print_binder_transaction(struct seq_file *m, const char *prefix,
 static void print_binder_buffer(struct seq_file *m, const char *prefix,
                                struct binder_buffer *buffer)
 {
-       seq_printf(m, "%s %d: %p size %zd:%zd %s\n",
+       seq_printf(m, "%s %d: %pK size %zd:%zd %s\n",
                   prefix, buffer->debug_id, buffer->data,
                   buffer->data_size, buffer->offsets_size,
                   buffer->transaction ? "active" : "delivered");
@@ -5007,7 +5020,7 @@ static void print_binder_node(struct seq_file *m, struct binder_node *node)
 
 static void print_binder_ref(struct seq_file *m, struct binder_ref *ref)
 {
-       seq_printf(m, "  ref %d: desc %d %snode %d s %d w %d d %p\n",
+       seq_printf(m, "  ref %d: desc %d %snode %d s %d w %d d %pK\n",
                   ref->debug_id, ref->desc, ref->node->proc ? "" : "dead ",
                   ref->node->debug_id, ref->strong, ref->weak, ref->death);
 }