Merge 4.20-rc5 into char-misc-next

We need the fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

3 files changed, 19 insertions, 21 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 54fdd99df9be..9f2059d24ae2 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3004,7 +3004,6 @@ static void binder_transaction(struct binder_proc *proc,
                 t->buffer = NULL;
                 goto err_binder_alloc_buf_failed;
         }
-        t->buffer->allow_user_free = 0;
         t->buffer->debug_id = t->debug_id;
         t->buffer->transaction = t;
         t->buffer->target_node = target_node;
@@ -3540,14 +3539,18 @@ static int binder_thread_write(struct binder_proc *proc,
 
                         buffer = binder_alloc_prepare_to_free(&proc->alloc,
                                                               data_ptr);
-                        if (buffer == NULL) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx no match\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
-                                break;
-                        }
-                        if (!buffer->allow_user_free) {
-                                binder_user_error("%d:%d BC_FREE_BUFFER u%016llx matched unreturned buffer\n",
-                                        proc->pid, thread->pid, (u64)data_ptr);
+                        if (IS_ERR_OR_NULL(buffer)) {
+                                if (PTR_ERR(buffer) == -EPERM) {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx matched unreturned or currently freeing buffer\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                } else {
+                                        binder_user_error(
+                                                "%d:%d BC_FREE_BUFFER u%016llx no match\n",
+                                                proc->pid, thread->pid,
+                                                (u64)data_ptr);
+                                }
                                 break;
                         }
                         binder_debug(BINDER_DEBUG_FREE_BUFFER,
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 52eb11edf000..022cd80e80cc 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -151,16 +151,12 @@ static struct binder_buffer *binder_alloc_prepare_to_free_locked(
                 else {
                         /*
                          * Guard against user threads attempting to
-                         * free the buffer twice
+                         * free the buffer when in use by kernel or
+                         * after it's already been freed.
                          */
-                        if (buffer->free_in_progress) {
-                                binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
-                                                   "%d:%d FREE_BUFFER u%016llx user freed buffer twice\n",
-                                                   alloc->pid, current->pid,
-                                                   (u64)user_ptr);
-                                return NULL;
-                        }
-                        buffer->free_in_progress = 1;
+                        if (!buffer->allow_user_free)
+                                return ERR_PTR(-EPERM);
+                        buffer->allow_user_free = 0;
                         return buffer;
                 }
         }
@@ -500,7 +496,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked(
 
         rb_erase(best_fit, &alloc->free_buffers);
         buffer->free = 0;
-        buffer->free_in_progress = 0;
+        buffer->allow_user_free = 0;
         binder_insert_allocated_buffer_locked(alloc, buffer);
         binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
                      "%d: binder_alloc_buf size %zd got %pK\n",
diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
index 9ef64e563856..fb3238c74c8a 100644
--- a/drivers/android/binder_alloc.h
+++ b/drivers/android/binder_alloc.h
@@ -50,8 +50,7 @@ struct binder_buffer {
         unsigned free:1;
         unsigned allow_user_free:1;
         unsigned async_transaction:1;
-        unsigned free_in_progress:1;
-        unsigned debug_id:28;
+        unsigned debug_id:29;
 
         struct binder_transaction *transaction;