1 files changed, 113 insertions, 0 deletions

diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 022cd80e80cc..94c0d85c4e75 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -29,6 +29,8 @@
 #include <linux/list_lru.h>
 #include <linux/ratelimit.h>
 #include <asm/cacheflush.h>
+#include <linux/uaccess.h>
+#include <linux/highmem.h>
 #include "binder_alloc.h"
 #include "binder_trace.h"
 
@@ -1053,3 +1055,114 @@ int binder_alloc_shrinker_init(void)
         }
         return ret;
 }
+
+/**
+ * check_buffer() - verify that buffer/offset is safe to access
+ * @alloc: binder_alloc for this proc
+ * @buffer: binder buffer to be accessed
+ * @offset: offset into @buffer data
+ * @bytes: bytes to access from offset
+ *
+ * Check that the @offset/@bytes are within the size of the given
+ * @buffer and that the buffer is currently active and not freeable.
+ * Offsets must also be multiples of sizeof(u32). The kernel is
+ * allowed to touch the buffer in two cases:
+ *
+ * 1) when the buffer is being created:
+ *     (buffer->free == 0 && buffer->allow_user_free == 0)
+ * 2) when the buffer is being torn down:
+ *     (buffer->free == 0 && buffer->transaction == NULL).
+ *
+ * Return: true if the buffer is safe to access
+ */
+static inline bool check_buffer(struct binder_alloc *alloc,
+                                struct binder_buffer *buffer,
+                                binder_size_t offset, size_t bytes)
+{
+        size_t buffer_size = binder_alloc_buffer_size(alloc, buffer);
+
+        return buffer_size >= bytes &&
+                offset <= buffer_size - bytes &&
+                IS_ALIGNED(offset, sizeof(u32)) &&
+                !buffer->free &&
+                (!buffer->allow_user_free || !buffer->transaction);
+}
+
+/**
+ * binder_alloc_get_page() - get kernel pointer for given buffer offset
+ * @alloc: binder_alloc for this proc
+ * @buffer: binder buffer to be accessed
+ * @buffer_offset: offset into @buffer data
+ * @pgoffp: address to copy final page offset to
+ *
+ * Lookup the struct page corresponding to the address
+ * at @buffer_offset into @buffer->data. If @pgoffp is not
+ * NULL, the byte-offset into the page is written there.
+ *
+ * The caller is responsible to ensure that the offset points
+ * to a valid address within the @buffer and that @buffer is
+ * not freeable by the user. Since it can't be freed, we are
+ * guaranteed that the corresponding elements of @alloc->pages[]
+ * cannot change.
+ *
+ * Return: struct page
+ */
+static struct page *binder_alloc_get_page(struct binder_alloc *alloc,
+                                          struct binder_buffer *buffer,
+                                          binder_size_t buffer_offset,
+                                          pgoff_t *pgoffp)
+{
+        binder_size_t buffer_space_offset = buffer_offset +
+                (buffer->data - alloc->buffer);
+        pgoff_t pgoff = buffer_space_offset & ~PAGE_MASK;
+        size_t index = buffer_space_offset >> PAGE_SHIFT;
+        struct binder_lru_page *lru_page;
+
+        lru_page = &alloc->pages[index];
+        *pgoffp = pgoff;
+        return lru_page->page_ptr;
+}
+
+/**
+ * binder_alloc_copy_user_to_buffer() - copy src user to tgt user
+ * @alloc: binder_alloc for this proc
+ * @buffer: binder buffer to be accessed
+ * @buffer_offset: offset into @buffer data
+ * @from: userspace pointer to source buffer
+ * @bytes: bytes to copy
+ *
+ * Copy bytes from source userspace to target buffer.
+ *
+ * Return: bytes remaining to be copied
+ */
+unsigned long
+binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
+                                 struct binder_buffer *buffer,
+                                 binder_size_t buffer_offset,
+                                 const void __user *from,
+                                 size_t bytes)
+{
+        if (!check_buffer(alloc, buffer, buffer_offset, bytes))
+                return bytes;
+
+        while (bytes) {
+                unsigned long size;
+                unsigned long ret;
+                struct page *page;
+                pgoff_t pgoff;
+                void *kptr;
+
+                page = binder_alloc_get_page(alloc, buffer,
+                                             buffer_offset, &pgoff);
+                size = min_t(size_t, bytes, PAGE_SIZE - pgoff);
+                kptr = kmap(page) + pgoff;
+                ret = copy_from_user(kptr, from, size);
+                kunmap(page);
+                if (ret)
+                        return bytes - size + ret;
+                bytes -= size;
+                from += size;
+                buffer_offset += size;
+        }
+        return 0;
+}