lkml.org 
[lkml]   [2012]   [Jan]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 1/2] Staging: android: binder: Add some error checks
    Date
    - Add a mutex to protect against two processes mmapping the
    same binder_proc.
    - After locking mmap_sem, check that the vma we want to access
    (still) points to the same mm_struct.
    - Use proc->tsk instead of current to get the files struct since
    this is where we get the rlimit from.

    Signed-off-by: Arve Hjønnevåg <arve@android.com>
    ---
    drivers/staging/android/binder.c | 12 +++++++++++-
    1 files changed, 11 insertions(+), 1 deletions(-)

    diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
    index 7491801..846b429 100644
    --- a/drivers/staging/android/binder.c
    +++ b/drivers/staging/android/binder.c
    @@ -38,6 +38,7 @@

    static DEFINE_MUTEX(binder_lock);
    static DEFINE_MUTEX(binder_deferred_lock);
    +static DEFINE_MUTEX(binder_mmap_lock);

    static HLIST_HEAD(binder_procs);
    static HLIST_HEAD(binder_deferred_list);
    @@ -632,6 +633,11 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate,
    if (mm) {
    down_write(&mm->mmap_sem);
    vma = proc->vma;
    + if (vma && mm != vma->vm_mm) {
    + pr_err("binder: %d: vma mm and task mm mismatch\n",
    + proc->pid);
    + vma = NULL;
    + }
    }

    if (allocate == 0)
    @@ -2803,6 +2809,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
    }
    vma->vm_flags = (vma->vm_flags | VM_DONTCOPY) & ~VM_MAYWRITE;

    + mutex_lock(&binder_mmap_lock);
    if (proc->buffer) {
    ret = -EBUSY;
    failure_string = "already mapped";
    @@ -2817,6 +2824,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
    }
    proc->buffer = area->addr;
    proc->user_buffer_offset = vma->vm_start - (uintptr_t)proc->buffer;
    + mutex_unlock(&binder_mmap_lock);

    #ifdef CONFIG_CPU_CACHE_VIPT
    if (cache_is_vipt_aliasing()) {
    @@ -2849,7 +2857,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
    binder_insert_free_buffer(proc, buffer);
    proc->free_async_space = proc->buffer_size / 2;
    barrier();
    - proc->files = get_files_struct(current);
    + proc->files = get_files_struct(proc->tsk);
    proc->vma = vma;

    /*printk(KERN_INFO "binder_mmap: %d %lx-%lx maps %p\n",
    @@ -2860,10 +2868,12 @@ err_alloc_small_buf_failed:
    kfree(proc->pages);
    proc->pages = NULL;
    err_alloc_pages_failed:
    + mutex_lock(&binder_mmap_lock);
    vfree(proc->buffer);
    proc->buffer = NULL;
    err_get_vm_area_failed:
    err_already_mapped:
    + mutex_unlock(&binder_mmap_lock);
    err_bad_arg:
    printk(KERN_ERR "binder_mmap: %d %lx-%lx %s failed %d\n",
    proc->pid, vma->vm_start, vma->vm_end, failure_string, ret);
    --
    1.7.7.3
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2012-01-21 04:59    [W:0.023 / U:1.520 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site