linux-stable.git/drivers/staging/android/binder.c, branch v3.3.4

Staging: android: binder: Fix crashes when sharing a binder file between processes

2012-02-08T22:14:13+00:00

Opening the binder driver and sharing the file returned with
other processes (e.g. by calling fork) can crash the kernel.
Prevent these crashes with the following changes:
- Add a mutex to protect against two processes mmapping the
  same binder_proc.
- After locking mmap_sem, check that the vma we want to access
  (still) points to the same mm_struct.
- Use proc->tsk instead of current to get the files struct since
  this is where we get the rlimit from.

Signed-off-by: Arve Hjønnevåg 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

Staging: android: binder: Don't call dump_stack in binder_vma_open

2012-02-08T22:14:13+00:00

If user-space partially unmaps the driver, binder_vma_open
would dump the kernel stack. This is not a kernel bug however
and will be treated as if the whole area was unmapped once
binder_vma_close gets called.

Signed-off-by: Arve Hjønnevåg 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

staging: binder: Fix memory corruption via page aliasing

2011-11-30T11:51:37+00:00

binder_deferred_release was not unmapping the page from the buffer
before freeing it, causing memory corruption.  This only happened
when page(s) had not been freed by binder_update_page_range, which
properly unmaps the pages.

This only happens on architectures with VIPT aliasing.

To reproduce, create a program which opens, mmaps, munmaps, then closes
the binder very quickly.  This should leave a page allocated when the
binder is released.  When binder_deferrred_release is called on the
close, the page will remain mapped to the address in the linear
proc->buffer.  Later, we may map the same physical page to a different
virtual address that has different coloring, and this may cause
aliasing to occur.

PAGE_POISONING will greatly increase your chances of noticing any
problems.

Signed-off-by: Christopher Lais 
Signed-off-by: Greg Kroah-Hartman

Staging: android: binder: Create dedicated workqueue for binder deferred work

2011-11-30T11:51:36+00:00

Some drivers flush the global workqueue when closed. This would deadlock if
the last reference to the file was released from the binder.

Signed-off-by: Arve Hjønnevåg 
Signed-off-by: Greg Kroah-Hartman

staging: android: binder: Move debugging information from procfs to debugfs

2011-11-30T11:49:07+00:00

Signed-off-by: Arve Hjønnevåg 
Signed-off-by: Greg Kroah-Hartman

binder: Use seq_file for debug interface.

2011-11-30T11:40:06+00:00

Signed-off-by: Arve Hjønnevåg 
Signed-off-by: Greg Kroah-Hartman

android-common: Fix slab.h includes for 2.6.34-rc4

2011-11-30T11:30:14+00:00

Signed-off-by: Greg Kroah-Hartman

Revert "Staging: android: delete android drivers"

2011-11-30T11:18:14+00:00

This reverts commit b0a0ccfad85b3657fe999805df65f5cfe634ab8a.

Turns out I was wrong, we want these in the tree.

Note, I've disabled the drivers from the build at the moment, so other
patches can be applied to fix some build issues due to internal api
changes since the code was removed from the tree.

Cc: Arve Hjønnevåg 
Cc: Brian Swetland 
Signed-off-by: Greg Kroah-Hartman

Staging: android: delete android drivers

2009-12-11T20:23:21+00:00

These drivers are no longer being developed and the original authors
seem to have abandonded them and hence, do not want them in the mainline
kernel tree.

So sad :(

Cc: Brian Swetland 
Signed-off-by: Greg Kroah-Hartman

staging: Make some structures static

2009-09-15T19:02:24+00:00

This was done using a semantic patch (http://coccinelle.lip6.fr/) that
checks that the declaration is not inside a function definition, that the
defined variable is not exported using EXPORTED_SYMBOL, etc, and that the
defined variable does not occur in any other file.  If these conditions
hold, static is added before the declaration.

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman