Message-ID: <20231207134213.25631ae9@canb.auug.org.au>
Date:   Thu, 7 Dec 2023 13:42:13 +1100
From:   Stephen Rothwell <sfr@...b.auug.org.au>
To:     Greg KH <greg@...ah.com>, Arnd Bergmann <arnd@...db.de>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     Carlos Llamas <cmllamas@...gle.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing List <linux-next@...r.kernel.org>,
        Nhat Pham <nphamcs@...il.com>
Subject: linux-next: manual merge of the char-misc tree with the mm tree

Hi all,

Today's linux-next merge of the char-misc tree got a conflict in:

  drivers/android/binder_alloc.c

between commit:

  8b59d7857c30 ("list_lru: allow explicit memcg and NUMA node selection")

from the mm tree and commits:

  ea9cdbf0c727 ("binder: rename lru shrinker utilities")
  ea2735ce19c1 ("binder: refactor page range allocation")
(and maybe others)

from the char-misc tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc drivers/android/binder_alloc.c
index f69d30c9f50f,a4a4dc87ba53..000000000000
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@@ -178,55 -175,141 +175,141 @@@ struct binder_buffer *binder_alloc_prep
  	return buffer;
  }
  
- static int binder_update_page_range(struct binder_alloc *alloc, int allocate,
- 				    void __user *start, void __user *end)
+ static inline void
+ binder_set_installed_page(struct binder_lru_page *lru_page,
+ 			  struct page *page)
+ {
+ 	/* Pairs with acquire in binder_get_installed_page() */
+ 	smp_store_release(&lru_page->page_ptr, page);
+ }
+ 
+ static inline struct page *
+ binder_get_installed_page(struct binder_lru_page *lru_page)
+ {
+ 	/* Pairs with release in binder_set_installed_page() */
+ 	return smp_load_acquire(&lru_page->page_ptr);
+ }
+ 
+ static void binder_lru_freelist_add(struct binder_alloc *alloc,
+ 				    unsigned long start, unsigned long end)
  {
- 	void __user *page_addr;
- 	unsigned long user_page_addr;
  	struct binder_lru_page *page;
- 	struct vm_area_struct *vma = NULL;
- 	struct mm_struct *mm = NULL;
- 	bool need_mm = false;
+ 	unsigned long page_addr;
  
- 	binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
- 		     "%d: %s pages %pK-%pK\n", alloc->pid,
- 		     allocate ? "allocate" : "free", start, end);
- 
- 	if (end <= start)
- 		return 0;
- 
- 	trace_binder_update_page_range(alloc, allocate, start, end);
- 
- 	if (allocate == 0)
- 		goto free_range;
+ 	trace_binder_update_page_range(alloc, false, start, end);
  
  	for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
- 		page = &alloc->pages[(page_addr - alloc->buffer) / PAGE_SIZE];
- 		if (!page->page_ptr) {
- 			need_mm = true;
- 			break;
- 		}
- 	}
- 
- 	if (need_mm && mmget_not_zero(alloc->mm))
- 		mm = alloc->mm;
- 
- 	if (mm) {
- 		mmap_write_lock(mm);
- 		vma = alloc->vma;
- 	}
- 
- 	if (!vma && need_mm) {
- 		binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
- 				   "%d: binder_alloc_buf failed to map pages in userspace, no vma\n",
- 				   alloc->pid);
- 		goto err_no_vma;
- 	}
- 
- 	for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
- 		int ret;
- 		bool on_lru;
  		size_t index;
+ 		int ret;
+ 
+ 		index = (page_addr - alloc->buffer) / PAGE_SIZE;
+ 		page = &alloc->pages[index];
+ 
+ 		if (!binder_get_installed_page(page))
+ 			continue;
+ 
+ 		trace_binder_free_lru_start(alloc, index);
+ 
 -		ret = list_lru_add(&binder_freelist, &page->lru);
++		ret = list_lru_add_obj(&binder_freelist, &page->lru);
+ 		WARN_ON(!ret);
+ 
+ 		trace_binder_free_lru_end(alloc, index);
+ 	}
+ }
+ 
+ static int binder_install_single_page(struct binder_alloc *alloc,
+ 				      struct binder_lru_page *lru_page,
+ 				      unsigned long addr)
+ {
+ 	struct page *page;
+ 	int ret = 0;
+ 
+ 	if (!mmget_not_zero(alloc->mm))
+ 		return -ESRCH;
+ 
+ 	/*
+ 	 * Protected with mmap_sem in write mode as multiple tasks
+ 	 * might race to install the same page.
+ 	 */
+ 	mmap_write_lock(alloc->mm);
+ 	if (binder_get_installed_page(lru_page))
+ 		goto out;
+ 
+ 	if (!alloc->vma) {
+ 		pr_err("%d: %s failed, no vma\n", alloc->pid, __func__);
+ 		ret = -ESRCH;
+ 		goto out;
+ 	}
+ 
+ 	page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
+ 	if (!page) {
+ 		pr_err("%d: failed to allocate page\n", alloc->pid);
+ 		ret = -ENOMEM;
+ 		goto out;
+ 	}
+ 
+ 	ret = vm_insert_page(alloc->vma, addr, page);
+ 	if (ret) {
+ 		pr_err("%d: %s failed to insert page at offset %lx with %d\n",
+ 		       alloc->pid, __func__, addr - alloc->buffer, ret);
+ 		__free_page(page);
+ 		ret = -ENOMEM;
+ 		goto out;
+ 	}
+ 
+ 	/* Mark page installation complete and safe to use */
+ 	binder_set_installed_page(lru_page, page);
+ out:
+ 	mmap_write_unlock(alloc->mm);
+ 	mmput_async(alloc->mm);
+ 	return ret;
+ }
+ 
+ static int binder_install_buffer_pages(struct binder_alloc *alloc,
+ 				       struct binder_buffer *buffer,
+ 				       size_t size)
+ {
+ 	struct binder_lru_page *page;
+ 	unsigned long start, final;
+ 	unsigned long page_addr;
+ 
+ 	start = buffer->user_data & PAGE_MASK;
+ 	final = PAGE_ALIGN(buffer->user_data + size);
+ 
+ 	for (page_addr = start; page_addr < final; page_addr += PAGE_SIZE) {
+ 		unsigned long index;
+ 		int ret;
+ 
+ 		index = (page_addr - alloc->buffer) / PAGE_SIZE;
+ 		page = &alloc->pages[index];
+ 
+ 		if (binder_get_installed_page(page))
+ 			continue;
+ 
+ 		trace_binder_alloc_page_start(alloc, index);
+ 
+ 		ret = binder_install_single_page(alloc, page, page_addr);
+ 		if (ret)
+ 			return ret;
+ 
+ 		trace_binder_alloc_page_end(alloc, index);
+ 	}
+ 
+ 	return 0;
+ }
+ 
+ /* The range of pages should exclude those shared with other buffers */
+ static void binder_lru_freelist_del(struct binder_alloc *alloc,
+ 				    unsigned long start, unsigned long end)
+ {
+ 	struct binder_lru_page *page;
+ 	unsigned long page_addr;
+ 
+ 	trace_binder_update_page_range(alloc, true, start, end);
+ 
+ 	for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
+ 		unsigned long index;
+ 		bool on_lru;
  
  		index = (page_addr - alloc->buffer) / PAGE_SIZE;
  		page = &alloc->pages[index];
@@@ -234,7 -317,7 +317,7 @@@
  		if (page->page_ptr) {
  			trace_binder_alloc_lru_start(alloc, index);
  
- 			on_lru = list_lru_del_obj(&binder_alloc_lru, &page->lru);
 -			on_lru = list_lru_del(&binder_freelist, &page->lru);
++			on_lru = list_lru_del_obj(&binder_freelist, &page->lru);
  			WARN_ON(!on_lru);
  
  			trace_binder_alloc_lru_end(alloc, index);
@@@ -1193,6 -771,448 +771,448 @@@ static void binder_alloc_clear_buf(stru
  	}
  }
  
+ /**
+  * binder_alloc_free_buf() - free a binder buffer
+  * @alloc:	binder_alloc for this proc
+  * @buffer:	kernel pointer to buffer
+  *
+  * Free the buffer allocated via binder_alloc_new_buf()
+  */
+ void binder_alloc_free_buf(struct binder_alloc *alloc,
+ 			    struct binder_buffer *buffer)
+ {
+ 	/*
+ 	 * We could eliminate the call to binder_alloc_clear_buf()
+ 	 * from binder_alloc_deferred_release() by moving this to
+ 	 * binder_free_buf_locked(). However, that could
+ 	 * increase contention for the alloc->lock if clear_on_free
+ 	 * is used frequently for large buffers. This lock is not
+ 	 * needed for correctness here.
+ 	 */
+ 	if (buffer->clear_on_free) {
+ 		binder_alloc_clear_buf(alloc, buffer);
+ 		buffer->clear_on_free = false;
+ 	}
+ 	spin_lock(&alloc->lock);
+ 	binder_free_buf_locked(alloc, buffer);
+ 	spin_unlock(&alloc->lock);
+ }
+ 
+ /**
+  * binder_alloc_mmap_handler() - map virtual address space for proc
+  * @alloc:	alloc structure for this proc
+  * @vma:	vma passed to mmap()
+  *
+  * Called by binder_mmap() to initialize the space specified in
+  * vma for allocating binder buffers
+  *
+  * Return:
+  *      0 = success
+  *      -EBUSY = address space already mapped
+  *      -ENOMEM = failed to map memory to given address space
+  */
+ int binder_alloc_mmap_handler(struct binder_alloc *alloc,
+ 			      struct vm_area_struct *vma)
+ {
+ 	struct binder_buffer *buffer;
+ 	const char *failure_string;
+ 	int ret, i;
+ 
+ 	if (unlikely(vma->vm_mm != alloc->mm)) {
+ 		ret = -EINVAL;
+ 		failure_string = "invalid vma->vm_mm";
+ 		goto err_invalid_mm;
+ 	}
+ 
+ 	mutex_lock(&binder_alloc_mmap_lock);
+ 	if (alloc->buffer_size) {
+ 		ret = -EBUSY;
+ 		failure_string = "already mapped";
+ 		goto err_already_mapped;
+ 	}
+ 	alloc->buffer_size = min_t(unsigned long, vma->vm_end - vma->vm_start,
+ 				   SZ_4M);
+ 	mutex_unlock(&binder_alloc_mmap_lock);
+ 
+ 	alloc->buffer = vma->vm_start;
+ 
+ 	alloc->pages = kcalloc(alloc->buffer_size / PAGE_SIZE,
+ 			       sizeof(alloc->pages[0]),
+ 			       GFP_KERNEL);
+ 	if (alloc->pages == NULL) {
+ 		ret = -ENOMEM;
+ 		failure_string = "alloc page array";
+ 		goto err_alloc_pages_failed;
+ 	}
+ 
+ 	for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
+ 		alloc->pages[i].alloc = alloc;
+ 		INIT_LIST_HEAD(&alloc->pages[i].lru);
+ 	}
+ 
+ 	buffer = kzalloc(sizeof(*buffer), GFP_KERNEL);
+ 	if (!buffer) {
+ 		ret = -ENOMEM;
+ 		failure_string = "alloc buffer struct";
+ 		goto err_alloc_buf_struct_failed;
+ 	}
+ 
+ 	buffer->user_data = alloc->buffer;
+ 	list_add(&buffer->entry, &alloc->buffers);
+ 	buffer->free = 1;
+ 	binder_insert_free_buffer(alloc, buffer);
+ 	alloc->free_async_space = alloc->buffer_size / 2;
+ 
+ 	/* Signal binder_alloc is fully initialized */
+ 	binder_alloc_set_vma(alloc, vma);
+ 
+ 	return 0;
+ 
+ err_alloc_buf_struct_failed:
+ 	kfree(alloc->pages);
+ 	alloc->pages = NULL;
+ err_alloc_pages_failed:
+ 	alloc->buffer = 0;
+ 	mutex_lock(&binder_alloc_mmap_lock);
+ 	alloc->buffer_size = 0;
+ err_already_mapped:
+ 	mutex_unlock(&binder_alloc_mmap_lock);
+ err_invalid_mm:
+ 	binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
+ 			   "%s: %d %lx-%lx %s failed %d\n", __func__,
+ 			   alloc->pid, vma->vm_start, vma->vm_end,
+ 			   failure_string, ret);
+ 	return ret;
+ }
+ 
+ 
+ void binder_alloc_deferred_release(struct binder_alloc *alloc)
+ {
+ 	struct rb_node *n;
+ 	int buffers, page_count;
+ 	struct binder_buffer *buffer;
+ 
+ 	buffers = 0;
+ 	spin_lock(&alloc->lock);
+ 	BUG_ON(alloc->vma);
+ 
+ 	while ((n = rb_first(&alloc->allocated_buffers))) {
+ 		buffer = rb_entry(n, struct binder_buffer, rb_node);
+ 
+ 		/* Transaction should already have been freed */
+ 		BUG_ON(buffer->transaction);
+ 
+ 		if (buffer->clear_on_free) {
+ 			binder_alloc_clear_buf(alloc, buffer);
+ 			buffer->clear_on_free = false;
+ 		}
+ 		binder_free_buf_locked(alloc, buffer);
+ 		buffers++;
+ 	}
+ 
+ 	while (!list_empty(&alloc->buffers)) {
+ 		buffer = list_first_entry(&alloc->buffers,
+ 					  struct binder_buffer, entry);
+ 		WARN_ON(!buffer->free);
+ 
+ 		list_del(&buffer->entry);
+ 		WARN_ON_ONCE(!list_empty(&alloc->buffers));
+ 		kfree(buffer);
+ 	}
+ 
+ 	page_count = 0;
+ 	if (alloc->pages) {
+ 		int i;
+ 
+ 		for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
+ 			unsigned long page_addr;
+ 			bool on_lru;
+ 
+ 			if (!alloc->pages[i].page_ptr)
+ 				continue;
+ 
 -			on_lru = list_lru_del(&binder_freelist,
++			on_lru = list_lru_del_obj(&binder_freelist,
+ 					      &alloc->pages[i].lru);
+ 			page_addr = alloc->buffer + i * PAGE_SIZE;
+ 			binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
+ 				     "%s: %d: page %d %s\n",
+ 				     __func__, alloc->pid, i,
+ 				     on_lru ? "on lru" : "active");
+ 			__free_page(alloc->pages[i].page_ptr);
+ 			page_count++;
+ 		}
+ 		kfree(alloc->pages);
+ 	}
+ 	spin_unlock(&alloc->lock);
+ 	if (alloc->mm)
+ 		mmdrop(alloc->mm);
+ 
+ 	binder_alloc_debug(BINDER_DEBUG_OPEN_CLOSE,
+ 		     "%s: %d buffers %d, pages %d\n",
+ 		     __func__, alloc->pid, buffers, page_count);
+ }
+ 
+ /**
+  * binder_alloc_print_allocated() - print buffer info
+  * @m:     seq_file for output via seq_printf()
+  * @alloc: binder_alloc for this proc
+  *
+  * Prints information about every buffer associated with
+  * the binder_alloc state to the given seq_file
+  */
+ void binder_alloc_print_allocated(struct seq_file *m,
+ 				  struct binder_alloc *alloc)
+ {
+ 	struct binder_buffer *buffer;
+ 	struct rb_node *n;
+ 
+ 	spin_lock(&alloc->lock);
+ 	for (n = rb_first(&alloc->allocated_buffers); n; n = rb_next(n)) {
+ 		buffer = rb_entry(n, struct binder_buffer, rb_node);
+ 		seq_printf(m, "  buffer %d: %lx size %zd:%zd:%zd %s\n",
+ 			   buffer->debug_id,
+ 			   buffer->user_data - alloc->buffer,
+ 			   buffer->data_size, buffer->offsets_size,
+ 			   buffer->extra_buffers_size,
+ 			   buffer->transaction ? "active" : "delivered");
+ 	}
+ 	spin_unlock(&alloc->lock);
+ }
+ 
+ /**
+  * binder_alloc_print_pages() - print page usage
+  * @m:     seq_file for output via seq_printf()
+  * @alloc: binder_alloc for this proc
+  */
+ void binder_alloc_print_pages(struct seq_file *m,
+ 			      struct binder_alloc *alloc)
+ {
+ 	struct binder_lru_page *page;
+ 	int i;
+ 	int active = 0;
+ 	int lru = 0;
+ 	int free = 0;
+ 
+ 	spin_lock(&alloc->lock);
+ 	/*
+ 	 * Make sure the binder_alloc is fully initialized, otherwise we might
+ 	 * read inconsistent state.
+ 	 */
+ 	if (binder_alloc_get_vma(alloc) != NULL) {
+ 		for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
+ 			page = &alloc->pages[i];
+ 			if (!page->page_ptr)
+ 				free++;
+ 			else if (list_empty(&page->lru))
+ 				active++;
+ 			else
+ 				lru++;
+ 		}
+ 	}
+ 	spin_unlock(&alloc->lock);
+ 	seq_printf(m, "  pages: %d:%d:%d\n", active, lru, free);
+ 	seq_printf(m, "  pages high watermark: %zu\n", alloc->pages_high);
+ }
+ 
+ /**
+  * binder_alloc_get_allocated_count() - return count of buffers
+  * @alloc: binder_alloc for this proc
+  *
+  * Return: count of allocated buffers
+  */
+ int binder_alloc_get_allocated_count(struct binder_alloc *alloc)
+ {
+ 	struct rb_node *n;
+ 	int count = 0;
+ 
+ 	spin_lock(&alloc->lock);
+ 	for (n = rb_first(&alloc->allocated_buffers); n != NULL; n = rb_next(n))
+ 		count++;
+ 	spin_unlock(&alloc->lock);
+ 	return count;
+ }
+ 
+ 
+ /**
+  * binder_alloc_vma_close() - invalidate address space
+  * @alloc: binder_alloc for this proc
+  *
+  * Called from binder_vma_close() when releasing address space.
+  * Clears alloc->vma to prevent new incoming transactions from
+  * allocating more buffers.
+  */
+ void binder_alloc_vma_close(struct binder_alloc *alloc)
+ {
+ 	binder_alloc_set_vma(alloc, NULL);
+ }
+ 
+ /**
+  * binder_alloc_free_page() - shrinker callback to free pages
+  * @item:   item to free
+  * @lock:   lock protecting the item
+  * @cb_arg: callback argument
+  *
+  * Called from list_lru_walk() in binder_shrink_scan() to free
+  * up pages when the system is under memory pressure.
+  */
+ enum lru_status binder_alloc_free_page(struct list_head *item,
+ 				       struct list_lru_one *lru,
+ 				       spinlock_t *lock,
+ 				       void *cb_arg)
+ 	__must_hold(lock)
+ {
+ 	struct binder_lru_page *page = container_of(item, typeof(*page), lru);
+ 	struct binder_alloc *alloc = page->alloc;
+ 	struct mm_struct *mm = alloc->mm;
+ 	struct vm_area_struct *vma;
+ 	struct page *page_to_free;
+ 	unsigned long page_addr;
+ 	size_t index;
+ 
+ 	if (!mmget_not_zero(mm))
+ 		goto err_mmget;
+ 	if (!mmap_read_trylock(mm))
+ 		goto err_mmap_read_lock_failed;
+ 	if (!spin_trylock(&alloc->lock))
+ 		goto err_get_alloc_lock_failed;
+ 	if (!page->page_ptr)
+ 		goto err_page_already_freed;
+ 
+ 	index = page - alloc->pages;
+ 	page_addr = alloc->buffer + index * PAGE_SIZE;
+ 
+ 	vma = vma_lookup(mm, page_addr);
+ 	if (vma && vma != binder_alloc_get_vma(alloc))
+ 		goto err_invalid_vma;
+ 
+ 	trace_binder_unmap_kernel_start(alloc, index);
+ 
+ 	page_to_free = page->page_ptr;
+ 	page->page_ptr = NULL;
+ 
+ 	trace_binder_unmap_kernel_end(alloc, index);
+ 
+ 	list_lru_isolate(lru, item);
+ 	spin_unlock(&alloc->lock);
+ 	spin_unlock(lock);
+ 
+ 	if (vma) {
+ 		trace_binder_unmap_user_start(alloc, index);
+ 
+ 		zap_page_range_single(vma, page_addr, PAGE_SIZE, NULL);
+ 
+ 		trace_binder_unmap_user_end(alloc, index);
+ 	}
+ 
+ 	mmap_read_unlock(mm);
+ 	mmput_async(mm);
+ 	__free_page(page_to_free);
+ 
+ 	spin_lock(lock);
+ 	return LRU_REMOVED_RETRY;
+ 
+ err_invalid_vma:
+ err_page_already_freed:
+ 	spin_unlock(&alloc->lock);
+ err_get_alloc_lock_failed:
+ 	mmap_read_unlock(mm);
+ err_mmap_read_lock_failed:
+ 	mmput_async(mm);
+ err_mmget:
+ 	return LRU_SKIP;
+ }
+ 
+ static unsigned long
+ binder_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
+ {
+ 	return list_lru_count(&binder_freelist);
+ }
+ 
+ static unsigned long
+ binder_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
+ {
+ 	return list_lru_walk(&binder_freelist, binder_alloc_free_page,
+ 			    NULL, sc->nr_to_scan);
+ }
+ 
+ static struct shrinker *binder_shrinker;
+ 
+ /**
+  * binder_alloc_init() - called by binder_open() for per-proc initialization
+  * @alloc: binder_alloc for this proc
+  *
+  * Called from binder_open() to initialize binder_alloc fields for
+  * new binder proc
+  */
+ void binder_alloc_init(struct binder_alloc *alloc)
+ {
+ 	alloc->pid = current->group_leader->pid;
+ 	alloc->mm = current->mm;
+ 	mmgrab(alloc->mm);
+ 	spin_lock_init(&alloc->lock);
+ 	INIT_LIST_HEAD(&alloc->buffers);
+ }
+ 
+ int binder_alloc_shrinker_init(void)
+ {
+ 	int ret;
+ 
+ 	ret = list_lru_init(&binder_freelist);
+ 	if (ret)
+ 		return ret;
+ 
+ 	binder_shrinker = shrinker_alloc(0, "android-binder");
+ 	if (!binder_shrinker) {
+ 		list_lru_destroy(&binder_freelist);
+ 		return -ENOMEM;
+ 	}
+ 
+ 	binder_shrinker->count_objects = binder_shrink_count;
+ 	binder_shrinker->scan_objects = binder_shrink_scan;
+ 
+ 	shrinker_register(binder_shrinker);
+ 
+ 	return 0;
+ }
+ 
+ void binder_alloc_shrinker_exit(void)
+ {
+ 	shrinker_free(binder_shrinker);
+ 	list_lru_destroy(&binder_freelist);
+ }
+ 
+ /**
+  * check_buffer() - verify that buffer/offset is safe to access
+  * @alloc: binder_alloc for this proc
+  * @buffer: binder buffer to be accessed
+  * @offset: offset into @buffer data
+  * @bytes: bytes to access from offset
+  *
+  * Check that the @offset/@...es are within the size of the given
+  * @buffer and that the buffer is currently active and not freeable.
+  * Offsets must also be multiples of sizeof(u32). The kernel is
+  * allowed to touch the buffer in two cases:
+  *
+  * 1) when the buffer is being created:
+  *     (buffer->free == 0 && buffer->allow_user_free == 0)
+  * 2) when the buffer is being torn down:
+  *     (buffer->free == 0 && buffer->transaction == NULL).
+  *
+  * Return: true if the buffer is safe to access
+  */
+ static inline bool check_buffer(struct binder_alloc *alloc,
+ 				struct binder_buffer *buffer,
+ 				binder_size_t offset, size_t bytes)
+ {
+ 	size_t buffer_size = binder_alloc_buffer_size(alloc, buffer);
+ 
+ 	return buffer_size >= bytes &&
+ 		offset <= buffer_size - bytes &&
+ 		IS_ALIGNED(offset, sizeof(u32)) &&
+ 		!buffer->free &&
+ 		(!buffer->allow_user_free || !buffer->transaction);
+ }
+ 
  /**
   * binder_alloc_copy_user_to_buffer() - copy src user to tgt user
   * @alloc: binder_alloc for this proc

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists