Changes in 4.14.324 lib/mpi: Eliminate unused umul_ppmm definitions for MIPS drm/radeon: Fix integer overflow in radeon_cs_parser_init ALSA: emu10k1: roll up loops in DSP setup code for Audigy quota: Properly disable quotas when add_dquot_ref() fails quota: fix warning in dqgrab() udf: Fix uninitialized array access for some pathnames fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev MIPS: dec: prom: Address -Warray-bounds warning FS: JFS: Fix null-ptr-deref Read in txBegin FS: JFS: Check for read-only mounted filesystem in txBegin media: v4l2-mem2mem: add lock to protect parameter num_rdy media: platform: mediatek: vpu: fix NULL ptr dereference gfs2: Fix possible data races in gfs2_show_options() pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Bluetooth: L2CAP: Fix use-after-free drm/amdgpu: Fix potential fence use-after-free v2 fbdev: mmp: fix value check in mmphw_probe() net: xfrm: Fix xfrm_address_filter OOB read net: af_key: fix sadb_x_filter validation ip6_vti: fix slab-use-after-free in decode_session6 ip_vti: fix potential slab-use-after-free in decode_session6 xfrm: add NULL check in xfrm_update_ae_params netfilter: nft_dynset: disallow object maps team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves i40e: fix misleading debug logs sock: Fix misuse of sk_under_memory_pressure() net: do not allow gso_size to be set to GSO_BY_FRAGS ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. cifs: Release folio lock on fscache read hit. mmc: wbsd: fix double mmc_free_host() in wbsd_init() serial: 8250: Fix oops for port->pm on uart_change_pm() binder: fix memory leak in binder_init() test_firmware: prevent race conditions by a correct implementation of locking netfilter: set default timeout to 3 secs for sctp shutdown send and recv state ASoC: rt5665: add missed regulator_bulk_disable af_unix: Fix null-ptr-deref in unix_stream_sendpage(). net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure net: phy: broadcom: stub c45 read/write for 54810 tracing: Fix memleak due to race between current_tracer and trace sock: annotate data-races around prot->memory_pressure igb: Avoid starting unnecessary workqueues ipvs: Improve robustness to the ipvs sysctl ipvs: fix racy memcpy in proc_do_sync_threshold ibmveth: Use dcbf rather than dcbfl batman-adv: Trigger events for auto adjusted MTU batman-adv: Do not get eth header before batadv_check_management_packet batman-adv: Fix TT global entry leak when client roamed back batman-adv: Fix batadv_v_ogm_aggr_send memory leak lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels media: vcodec: Fix potential array out-of-bounds in encoder queue_setup x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 rtnetlink: Reject negative ifindexes in RTM_NEWLINK scsi: snic: Fix double free in snic_tgt_create() scsi: core: raid_class: Remove raid_component_add() dma-buf/sw_sync: Avoid recursive lock during fence signal Linux 4.14.324 Change-Id: I91a1deeaf4c37592b26abd9d9314eff77329c0f0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
186 lines
6.4 KiB
C
186 lines
6.4 KiB
C
/*
|
|
* Copyright (C) 2017 Google, Inc.
|
|
*
|
|
* This software is licensed under the terms of the GNU General Public
|
|
* License version 2, as published by the Free Software Foundation, and
|
|
* may be copied, distributed, and modified under those terms.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
*/
|
|
|
|
#ifndef _LINUX_BINDER_ALLOC_H
|
|
#define _LINUX_BINDER_ALLOC_H
|
|
|
|
#include <linux/rbtree.h>
|
|
#include <linux/list.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/rtmutex.h>
|
|
#include <linux/vmalloc.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/list_lru.h>
|
|
#include <uapi/linux/android/binder.h>
|
|
|
|
extern struct list_lru binder_alloc_lru;
|
|
struct binder_transaction;
|
|
|
|
/**
|
|
* struct binder_buffer - buffer used for binder transactions
|
|
* @entry: entry alloc->buffers
|
|
* @rb_node: node for allocated_buffers/free_buffers rb trees
|
|
* @free: %true if buffer is free
|
|
* @allow_user_free: %true if user is allowed to free buffer
|
|
* @async_transaction: %true if buffer is in use for an async txn
|
|
* @debug_id: unique ID for debugging
|
|
* @transaction: pointer to associated struct binder_transaction
|
|
* @target_node: struct binder_node associated with this buffer
|
|
* @data_size: size of @transaction data
|
|
* @offsets_size: size of array of offsets
|
|
* @extra_buffers_size: size of space for other objects (like sg lists)
|
|
* @user_data: user pointer to base of buffer space
|
|
*
|
|
* Bookkeeping structure for binder transaction buffers
|
|
*/
|
|
struct binder_buffer {
|
|
struct list_head entry; /* free and allocated entries by address */
|
|
struct rb_node rb_node; /* free entry by size or allocated entry */
|
|
/* by address */
|
|
unsigned free:1;
|
|
unsigned allow_user_free:1;
|
|
unsigned async_transaction:1;
|
|
unsigned debug_id:29;
|
|
|
|
struct binder_transaction *transaction;
|
|
|
|
struct binder_node *target_node;
|
|
size_t data_size;
|
|
size_t offsets_size;
|
|
size_t extra_buffers_size;
|
|
void __user *user_data;
|
|
};
|
|
|
|
/**
|
|
* struct binder_lru_page - page object used for binder shrinker
|
|
* @page_ptr: pointer to physical page in mmap'd space
|
|
* @lru: entry in binder_alloc_lru
|
|
* @alloc: binder_alloc for a proc
|
|
*/
|
|
struct binder_lru_page {
|
|
struct list_head lru;
|
|
struct page *page_ptr;
|
|
struct binder_alloc *alloc;
|
|
};
|
|
|
|
/**
|
|
* struct binder_alloc - per-binder proc state for binder allocator
|
|
* @vma: vm_area_struct passed to mmap_handler
|
|
* (invarient after mmap)
|
|
* @tsk: tid for task that called init for this proc
|
|
* (invariant after init)
|
|
* @vma_vm_mm: copy of vma->vm_mm (invarient after mmap)
|
|
* @buffer: base of per-proc address space mapped via mmap
|
|
* @buffers: list of all buffers for this proc
|
|
* @free_buffers: rb tree of buffers available for allocation
|
|
* sorted by size
|
|
* @allocated_buffers: rb tree of allocated buffers sorted by address
|
|
* @free_async_space: VA space available for async buffers. This is
|
|
* initialized at mmap time to 1/2 the full VA space
|
|
* @pages: array of binder_lru_page
|
|
* @buffer_size: size of address space specified via mmap
|
|
* @pid: pid for associated binder_proc (invariant after init)
|
|
* @pages_high: high watermark of offset in @pages
|
|
*
|
|
* Bookkeeping structure for per-proc address space management for binder
|
|
* buffers. It is normally initialized during binder_init() and binder_mmap()
|
|
* calls. The address space is used for both user-visible buffers and for
|
|
* struct binder_buffer objects used to track the user buffers
|
|
*/
|
|
struct binder_alloc {
|
|
struct mutex mutex;
|
|
struct vm_area_struct *vma;
|
|
struct mm_struct *vma_vm_mm;
|
|
void __user *buffer;
|
|
struct list_head buffers;
|
|
struct rb_root free_buffers;
|
|
struct rb_root allocated_buffers;
|
|
size_t free_async_space;
|
|
struct binder_lru_page *pages;
|
|
size_t buffer_size;
|
|
uint32_t buffer_free;
|
|
int pid;
|
|
size_t pages_high;
|
|
};
|
|
|
|
#ifdef CONFIG_ANDROID_BINDER_IPC_SELFTEST
|
|
void binder_selftest_alloc(struct binder_alloc *alloc);
|
|
#else
|
|
static inline void binder_selftest_alloc(struct binder_alloc *alloc) {}
|
|
#endif
|
|
enum lru_status binder_alloc_free_page(struct list_head *item,
|
|
struct list_lru_one *lru,
|
|
spinlock_t *lock, void *cb_arg);
|
|
extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
|
|
size_t data_size,
|
|
size_t offsets_size,
|
|
size_t extra_buffers_size,
|
|
int is_async);
|
|
extern void binder_alloc_init(struct binder_alloc *alloc);
|
|
extern int binder_alloc_shrinker_init(void);
|
|
extern void binder_alloc_shrinker_exit(void);
|
|
extern void binder_alloc_vma_close(struct binder_alloc *alloc);
|
|
extern struct binder_buffer *
|
|
binder_alloc_prepare_to_free(struct binder_alloc *alloc,
|
|
uintptr_t user_ptr);
|
|
extern void binder_alloc_free_buf(struct binder_alloc *alloc,
|
|
struct binder_buffer *buffer);
|
|
extern int binder_alloc_mmap_handler(struct binder_alloc *alloc,
|
|
struct vm_area_struct *vma);
|
|
extern void binder_alloc_deferred_release(struct binder_alloc *alloc);
|
|
extern int binder_alloc_get_allocated_count(struct binder_alloc *alloc);
|
|
extern void binder_alloc_print_allocated(struct seq_file *m,
|
|
struct binder_alloc *alloc);
|
|
void binder_alloc_print_pages(struct seq_file *m,
|
|
struct binder_alloc *alloc);
|
|
|
|
/**
|
|
* binder_alloc_get_free_async_space() - get free space available for async
|
|
* @alloc: binder_alloc for this proc
|
|
*
|
|
* Return: the bytes remaining in the address-space for async transactions
|
|
*/
|
|
static inline size_t
|
|
binder_alloc_get_free_async_space(struct binder_alloc *alloc)
|
|
{
|
|
size_t free_async_space;
|
|
|
|
mutex_lock(&alloc->mutex);
|
|
free_async_space = alloc->free_async_space;
|
|
mutex_unlock(&alloc->mutex);
|
|
return free_async_space;
|
|
}
|
|
|
|
unsigned long
|
|
binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
|
|
struct binder_buffer *buffer,
|
|
binder_size_t buffer_offset,
|
|
const void __user *from,
|
|
size_t bytes);
|
|
|
|
void binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
|
|
struct binder_buffer *buffer,
|
|
binder_size_t buffer_offset,
|
|
void *src,
|
|
size_t bytes);
|
|
|
|
void binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
|
|
void *dest,
|
|
struct binder_buffer *buffer,
|
|
binder_size_t buffer_offset,
|
|
size_t bytes);
|
|
|
|
#endif /* _LINUX_BINDER_ALLOC_H */
|
|
|