// SPDX-License-Identifier: GPL-2.0-only

/* binder.c

*

* Android IPC Subsystem

*

* Copyright (C) 2007-2008 Google, Inc.

*/

/*

* Locking overview

*

* There are 3 main spinlocks which must be acquired in the

* order shown:

*

* 1) proc->outer_lock : protects binder_ref

* binder_proc_lock() and binder_proc_unlock() are

* used to acq/rel.

* 2) node->lock : protects most fields of binder_node.

* binder_node_lock() and binder_node_unlock() are

* used to acq/rel

* 3) proc->inner_lock : protects the thread and node lists

* (proc->threads, proc->waiting_threads, proc->nodes)

* and all todo lists associated with the binder_proc

* (proc->todo, thread->todo, proc->delivered_death and

* node->async_todo), as well as thread->transaction_stack

* binder_inner_proc_lock() and binder_inner_proc_unlock()

* are used to acq/rel

*

* Any lock under procA must never be nested under any lock at the same

* level or below on procB.

*

* Functions that require a lock held on entry indicate which lock

* in the suffix of the function name:

*

* foo_olocked() : requires node->outer_lock

* foo_nlocked() : requires node->lock

* foo_ilocked() : requires proc->inner_lock

* foo_oilocked(): requires proc->outer_lock and proc->inner_lock

* foo_nilocked(): requires node->lock and proc->inner_lock

* ...

*/

#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

#include <linux/fdtable.h>

#include <linux/file.h>

#include <linux/freezer.h>

#include <linux/fs.h>

#include <linux/list.h>

#include <linux/miscdevice.h>

#include <linux/module.h>

#include <linux/mutex.h>

#include <linux/nsproxy.h>

#include <linux/poll.h>

#include <linux/debugfs.h>

#include <linux/rbtree.h>

#include <linux/sched/signal.h>

#include <linux/sched/mm.h>

#include <linux/seq_file.h>

#include <linux/string.h>

#include <linux/uaccess.h>

#include <linux/pid_namespace.h>

#include <linux/security.h>

#include <linux/spinlock.h>

#include <linux/ratelimit.h>

#include <linux/syscalls.h>

#include <linux/task_work.h>

#include <linux/sizes.h>

#include <linux/ktime.h>

#include <kunit/visibility.h>

#include <uapi/linux/android/binder.h>

#include <linux/cacheflush.h>

#include "binder_netlink.h"

#include "binder_internal.h"

#include "binder_trace.h"

static HLIST_HEAD(binder_deferred_list);

static DEFINE_MUTEX(binder_deferred_lock);

static HLIST_HEAD(binder_devices);

static DEFINE_SPINLOCK(binder_devices_lock);

static HLIST_HEAD(binder_procs);

static DEFINE_MUTEX(binder_procs_lock);

static HLIST_HEAD(binder_dead_nodes);

static DEFINE_SPINLOCK(binder_dead_nodes_lock);

static struct dentry *binder_debugfs_dir_entry_root;

static struct dentry *binder_debugfs_dir_entry_proc;

static atomic_t binder_last_id;

static int proc_show(struct seq_file *m, void *unused);

DEFINE_SHOW_ATTRIBUTE(proc);

#define FORBIDDEN_MMAP_FLAGS (VM_WRITE)

enum {

BINDER_DEBUG_USER_ERROR = 1U << 0,

BINDER_DEBUG_FAILED_TRANSACTION = 1U << 1,

BINDER_DEBUG_DEAD_TRANSACTION = 1U << 2,

BINDER_DEBUG_OPEN_CLOSE = 1U << 3,

BINDER_DEBUG_DEAD_BINDER = 1U << 4,

BINDER_DEBUG_DEATH_NOTIFICATION = 1U << 5,

BINDER_DEBUG_READ_WRITE = 1U << 6,

BINDER_DEBUG_USER_REFS = 1U << 7,

BINDER_DEBUG_THREADS = 1U << 8,

BINDER_DEBUG_TRANSACTION = 1U << 9,

BINDER_DEBUG_TRANSACTION_COMPLETE = 1U << 10,

BINDER_DEBUG_FREE_BUFFER = 1U << 11,

BINDER_DEBUG_INTERNAL_REFS = 1U << 12,

BINDER_DEBUG_PRIORITY_CAP = 1U << 13,

BINDER_DEBUG_SPINLOCKS = 1U << 14,

};

static uint32_t binder_debug_mask = BINDER_DEBUG_USER_ERROR |

BINDER_DEBUG_FAILED_TRANSACTION | BINDER_DEBUG_DEAD_TRANSACTION;

module_param_named(debug_mask, binder_debug_mask, uint, 0644);

char *binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;

module_param_named(devices, binder_devices_param, charp, 0444);

static DECLARE_WAIT_QUEUE_HEAD(binder_user_error_wait);

static int binder_stop_on_user_error;

static int binder_set_stop_on_user_error(const char *val,

const struct kernel_param *kp)

{

int ret;

ret = param_set_int(val, kp);

if (binder_stop_on_user_error < 2)

wake_up(&binder_user_error_wait);

return ret;

}

module_param_call(stop_on_user_error, binder_set_stop_on_user_error,

param_get_int, &binder_stop_on_user_error, 0644);

static __printf(2, 3) void binder_debug(int mask, const char *format, ...)

{

struct va_format vaf;

va_list args;

if (binder_debug_mask & mask) {

va_start(args, format);

vaf.va = &args;

vaf.fmt = format;

pr_info_ratelimited("%pV", &vaf);

va_end(args);

}

}

#define binder_txn_error(x...) \

binder_debug(BINDER_DEBUG_FAILED_TRANSACTION, x)

static __printf(1, 2) void binder_user_error(const char *format, ...)

{

struct va_format vaf;

va_list args;

if (binder_debug_mask & BINDER_DEBUG_USER_ERROR) {

va_start(args, format);

vaf.va = &args;

vaf.fmt = format;

pr_info_ratelimited("%pV", &vaf);

va_end(args);

}

if (binder_stop_on_user_error)

binder_stop_on_user_error = 2;

}

#define binder_set_extended_error(ee, _id, _command, _param) \

do { \

(ee)->id = _id; \

(ee)->command = _command; \

(ee)->param = _param; \

} while (0)

#define to_flat_binder_object(hdr) \

container_of(hdr, struct flat_binder_object, hdr)

#define to_binder_fd_object(hdr) container_of(hdr, struct binder_fd_object, hdr)

#define to_binder_buffer_object(hdr) \

container_of(hdr, struct binder_buffer_object, hdr)

#define to_binder_fd_array_object(hdr) \

container_of(hdr, struct binder_fd_array_object, hdr)

static struct binder_stats binder_stats;

static inline void binder_stats_deleted(enum binder_stat_types type)

{

atomic_inc(&binder_stats.obj_deleted[type]);

}

static inline void binder_stats_created(enum binder_stat_types type)

{

atomic_inc(&binder_stats.obj_created[type]);

}

struct binder_transaction_log_entry {

int debug_id;

int debug_id_done;

int call_type;

int from_proc;

int from_thread;

int target_handle;

int to_proc;

int to_thread;

int to_node;

int data_size;

int offsets_size;

int return_error_line;

uint32_t return_error;

uint32_t return_error_param;

char context_name[BINDERFS_MAX_NAME + 1];

};

struct binder_transaction_log {

atomic_t cur;

bool full;

struct binder_transaction_log_entry entry[32];

};

static struct binder_transaction_log binder_transaction_log;

static struct binder_transaction_log binder_transaction_log_failed;

static struct binder_transaction_log_entry *binder_transaction_log_add(

struct binder_transaction_log *log)

{

struct binder_transaction_log_entry *e;

unsigned int cur = atomic_inc_return(&log->cur);

if (cur >= ARRAY_SIZE(log->entry))

log->full = true;

e = &log->entry[cur % ARRAY_SIZE(log->entry)];

WRITE_ONCE(e->debug_id_done, 0);

/*

* write-barrier to synchronize access to e->debug_id_done.

* We make sure the initialized 0 value is seen before

* memset() other fields are zeroed by memset.

*/

smp_wmb();

memset(e, 0, sizeof(*e));

return e;

}

enum binder_deferred_state {

BINDER_DEFERRED_FLUSH = 0x01,

BINDER_DEFERRED_RELEASE = 0x02,

};

enum {

BINDER_LOOPER_STATE_REGISTERED = 0x01,

BINDER_LOOPER_STATE_ENTERED = 0x02,

BINDER_LOOPER_STATE_EXITED = 0x04,

BINDER_LOOPER_STATE_INVALID = 0x08,

BINDER_LOOPER_STATE_WAITING = 0x10,

BINDER_LOOPER_STATE_POLL = 0x20,

};

/**

* binder_proc_lock() - Acquire outer lock for given binder_proc

* @proc: struct binder_proc to acquire

*

* Acquires proc->outer_lock. Used to protect binder_ref

* structures associated with the given proc.

*/

#define binder_proc_lock(proc) _binder_proc_lock(proc, __LINE__)

static void

_binder_proc_lock(struct binder_proc *proc, int line)

__acquires(&proc->outer_lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_lock(&proc->outer_lock);

}

/**

* binder_proc_unlock() - Release outer lock for given binder_proc

* @proc: struct binder_proc to acquire

*

* Release lock acquired via binder_proc_lock()

*/

#define binder_proc_unlock(proc) _binder_proc_unlock(proc, __LINE__)

static void

_binder_proc_unlock(struct binder_proc *proc, int line)

__releases(&proc->outer_lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_unlock(&proc->outer_lock);

}

/**

* binder_inner_proc_lock() - Acquire inner lock for given binder_proc

* @proc: struct binder_proc to acquire

*

* Acquires proc->inner_lock. Used to protect todo lists

*/

#define binder_inner_proc_lock(proc) _binder_inner_proc_lock(proc, __LINE__)

static void

_binder_inner_proc_lock(struct binder_proc *proc, int line)

__acquires(&proc->inner_lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_lock(&proc->inner_lock);

}

/**

* binder_inner_proc_unlock() - Release inner lock for given binder_proc

* @proc: struct binder_proc to acquire

*

* Release lock acquired via binder_inner_proc_lock()

*/

#define binder_inner_proc_unlock(proc) _binder_inner_proc_unlock(proc, __LINE__)

static void

_binder_inner_proc_unlock(struct binder_proc *proc, int line)

__releases(&proc->inner_lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_unlock(&proc->inner_lock);

}

/**

* binder_node_lock() - Acquire spinlock for given binder_node

* @node: struct binder_node to acquire

*

* Acquires node->lock. Used to protect binder_node fields

*/

#define binder_node_lock(node) _binder_node_lock(node, __LINE__)

static void

_binder_node_lock(struct binder_node *node, int line)

__acquires(&node->lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_lock(&node->lock);

}

/**

* binder_node_unlock() - Release spinlock for given binder_proc

* @node: struct binder_node to acquire

*

* Release lock acquired via binder_node_lock()

*/

#define binder_node_unlock(node) _binder_node_unlock(node, __LINE__)

static void

_binder_node_unlock(struct binder_node *node, int line)

__releases(&node->lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_unlock(&node->lock);

}

/**

* binder_node_inner_lock() - Acquire node and inner locks

* @node: struct binder_node to acquire

*

* Acquires node->lock. If node->proc also acquires

* proc->inner_lock. Used to protect binder_node fields

*/

#define binder_node_inner_lock(node) _binder_node_inner_lock(node, __LINE__)

static void

_binder_node_inner_lock(struct binder_node *node, int line)

__acquires(&node->lock) __acquires(&node->proc->inner_lock)

{

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

spin_lock(&node->lock);

if (node->proc)

binder_inner_proc_lock(node->proc);

else

/* annotation for sparse */

__acquire(&node->proc->inner_lock);

}

/**

* binder_node_inner_unlock() - Release node and inner locks

* @node: struct binder_node to acquire

*

* Release lock acquired via binder_node_lock()

*/

#define binder_node_inner_unlock(node) _binder_node_inner_unlock(node, __LINE__)

static void

_binder_node_inner_unlock(struct binder_node *node, int line)

__releases(&node->lock) __releases(&node->proc->inner_lock)

{

struct binder_proc *proc = node->proc;

binder_debug(BINDER_DEBUG_SPINLOCKS,

"%s: line=%d\n", __func__, line);

if (proc)

binder_inner_proc_unlock(proc);

else

/* annotation for sparse */

__release(&node->proc->inner_lock);

spin_unlock(&node->lock);

}

static bool binder_worklist_empty_ilocked(struct list_head *list)

{

return list_empty(list);

}

/**

* binder_worklist_empty() - Check if no items on the work list

* @proc: binder_proc associated with list

* @list: list to check

*

* Return: true if there are no items on list, else false

*/

static bool binder_worklist_empty(struct binder_proc *proc,

struct list_head *list)

{

bool ret;

binder_inner_proc_lock(proc);

ret = binder_worklist_empty_ilocked(list);

binder_inner_proc_unlock(proc);

return ret;

}

/**

* binder_enqueue_work_ilocked() - Add an item to the work list

* @work: struct binder_work to add to list

* @target_list: list to add work to

*

* Adds the work to the specified list. Asserts that work

* is not already on a list.

*

* Requires the proc->inner_lock to be held.

*/

static void

binder_enqueue_work_ilocked(struct binder_work *work,

struct list_head *target_list)

{

BUG_ON(target_list == NULL);

BUG_ON(work->entry.next && !list_empty(&work->entry));

list_add_tail(&work->entry, target_list);

}

/**

* binder_enqueue_deferred_thread_work_ilocked() - Add deferred thread work

* @thread: thread to queue work to

* @work: struct binder_work to add to list

*

* Adds the work to the todo list of the thread. Doesn't set the process_todo

* flag, which means that (if it wasn't already set) the thread will go to

* sleep without handling this work when it calls read.

*

* Requires the proc->inner_lock to be held.

*/

static void

binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,

struct binder_work *work)

{

WARN_ON(!list_empty(&thread->waiting_thread_node));

binder_enqueue_work_ilocked(work, &thread->todo);

}

/**

* binder_enqueue_thread_work_ilocked() - Add an item to the thread work list

* @thread: thread to queue work to

* @work: struct binder_work to add to list

*

* Adds the work to the todo list of the thread, and enables processing

* of the todo queue.

*

* Requires the proc->inner_lock to be held.

*/

static void

binder_enqueue_thread_work_ilocked(struct binder_thread *thread,

struct binder_work *work)

{

WARN_ON(!list_empty(&thread->waiting_thread_node));

binder_enqueue_work_ilocked(work, &thread->todo);

/* (e)poll-based threads require an explicit wakeup signal when

* queuing their own work; they rely on these events to consume

* messages without I/O block. Without it, threads risk waiting

* indefinitely without handling the work.

*/

if (thread->looper & BINDER_LOOPER_STATE_POLL &&

thread->pid == current->pid && !thread->process_todo)

wake_up_interruptible_sync(&thread->wait);

thread->process_todo = true;

}

/**

* binder_enqueue_thread_work() - Add an item to the thread work list

* @thread: thread to queue work to

* @work: struct binder_work to add to list

*

* Adds the work to the todo list of the thread, and enables processing

* of the todo queue.

*/

static void

binder_enqueue_thread_work(struct binder_thread *thread,

struct binder_work *work)

{

binder_inner_proc_lock(thread->proc);

binder_enqueue_thread_work_ilocked(thread, work);

binder_inner_proc_unlock(thread->proc);

}

static void

binder_dequeue_work_ilocked(struct binder_work *work)

{

list_del_init(&work->entry);

}

/**

* binder_dequeue_work() - Removes an item from the work list

* @proc: binder_proc associated with list

* @work: struct binder_work to remove from list

*

* Removes the specified work item from whatever list it is on.

* Can safely be called if work is not on any list.

*/

static void

binder_dequeue_work(struct binder_proc *proc, struct binder_work *work)

{

binder_inner_proc_lock(proc);

binder_dequeue_work_ilocked(work);

binder_inner_proc_unlock(proc);

}

static struct binder_work *binder_dequeue_work_head_ilocked(

struct list_head *list)

{

struct binder_work *w;

w = list_first_entry_or_null(list, struct binder_work, entry);

if (w)

list_del_init(&w->entry);

return w;

}

static void

binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);

static void binder_free_thread(struct binder_thread *thread);

static void binder_free_proc(struct binder_proc *proc);

static void binder_inc_node_tmpref_ilocked(struct binder_node *node);

static bool binder_has_work_ilocked(struct binder_thread *thread,

bool do_proc_work)

{

return thread->process_todo ||

thread->looper_need_return ||

(do_proc_work &&

!binder_worklist_empty_ilocked(&thread->proc->todo));

}

static bool binder_has_work(struct binder_thread *thread, bool do_proc_work)

{

bool has_work;

binder_inner_proc_lock(thread->proc);

has_work = binder_has_work_ilocked(thread, do_proc_work);

binder_inner_proc_unlock(thread->proc);

return has_work;

}

static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)

{

return !thread->transaction_stack &&

binder_worklist_empty_ilocked(&thread->todo);

}

static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,

bool sync)

{

struct rb_node *n;

struct binder_thread *thread;

for (n = rb_first(&proc->threads); n != NULL; n = rb_next(n)) {

thread = rb_entry(n, struct binder_thread, rb_node);

if (thread->looper & BINDER_LOOPER_STATE_POLL &&

binder_available_for_proc_work_ilocked(thread)) {

if (sync)

wake_up_interruptible_sync(&thread->wait);

else

wake_up_interruptible(&thread->wait);

}

}

}

/**

* binder_select_thread_ilocked() - selects a thread for doing proc work.

* @proc: process to select a thread from

*

* Note that calling this function moves the thread off the waiting_threads

* list, so it can only be woken up by the caller of this function, or a

* signal. Therefore, callers *should* always wake up the thread this function

* returns.

*

* Return: If there's a thread currently waiting for process work,

* returns that thread. Otherwise returns NULL.

*/

static struct binder_thread *

binder_select_thread_ilocked(struct binder_proc *proc)

{

struct binder_thread *thread;

assert_spin_locked(&proc->inner_lock);

thread = list_first_entry_or_null(&proc->waiting_threads,

struct binder_thread,

waiting_thread_node);

if (thread)

list_del_init(&thread->waiting_thread_node);

return thread;

}

/**

* binder_wakeup_thread_ilocked() - wakes up a thread for doing proc work.

* @proc: process to wake up a thread in

* @thread: specific thread to wake-up (may be NULL)

* @sync: whether to do a synchronous wake-up

*

* This function wakes up a thread in the @proc process.

* The caller may provide a specific thread to wake-up in

* the @thread parameter. If @thread is NULL, this function

* will wake up threads that have called poll().

*

* Note that for this function to work as expected, callers

* should first call binder_select_thread() to find a thread

* to handle the work (if they don't have a thread already),

* and pass the result into the @thread parameter.

*/

static void binder_wakeup_thread_ilocked(struct binder_proc *proc,

struct binder_thread *thread,

bool sync)

{

assert_spin_locked(&proc->inner_lock);

if (thread) {

if (sync)

wake_up_interruptible_sync(&thread->wait);

else

wake_up_interruptible(&thread->wait);

return;

}

/* Didn't find a thread waiting for proc work; this can happen

* in two scenarios:

* 1. All threads are busy handling transactions

* In that case, one of those threads should call back into

* the kernel driver soon and pick up this work.

* 2. Threads are using the (e)poll interface, in which case

* they may be blocked on the waitqueue without having been

* added to waiting_threads. For this case, we just iterate

* over all threads not handling transaction work, and

* wake them all up. We wake all because we don't know whether

* a thread that called into (e)poll is handling non-binder

* work currently.

*/

binder_wakeup_poll_threads_ilocked(proc, sync);

}

static void binder_wakeup_proc_ilocked(struct binder_proc *proc)

{

struct binder_thread *thread = binder_select_thread_ilocked(proc);

binder_wakeup_thread_ilocked(proc, thread, /* sync = */false);

}

static void binder_set_nice(long nice)

{

long min_nice;

if (can_nice(current, nice)) {

set_user_nice(current, nice);

return;

}

min_nice = rlimit_to_nice(rlimit(RLIMIT_NICE));

binder_debug(BINDER_DEBUG_PRIORITY_CAP,

"%d: nice value %ld not allowed use %ld instead\n",

current->pid, nice, min_nice);

set_user_nice(current, min_nice);

if (min_nice <= MAX_NICE)

return;

binder_user_error("%d RLIMIT_NICE not set\n", current->pid);

}

static struct binder_node *binder_get_node_ilocked(struct binder_proc *proc,

binder_uintptr_t ptr)

{

struct rb_node *n = proc->nodes.rb_node;

struct binder_node *node;

assert_spin_locked(&proc->inner_lock);

while (n) {

node = rb_entry(n, struct binder_node, rb_node);

if (ptr < node->ptr)

n = n->rb_left;

else if (ptr > node->ptr)

n = n->rb_right;

else {

/*

* take an implicit weak reference

* to ensure node stays alive until

* call to binder_put_node()

*/

binder_inc_node_tmpref_ilocked(node);

return node;

}

}

return NULL;

}

static struct binder_node *binder_get_node(struct binder_proc *proc,

binder_uintptr_t ptr)

{

struct binder_node *node;

binder_inner_proc_lock(proc);

node = binder_get_node_ilocked(proc, ptr);

binder_inner_proc_unlock(proc);

return node;

}

static struct binder_node *binder_init_node_ilocked(

struct binder_proc *proc,

struct binder_node *new_node,

struct flat_binder_object *fp)

{

struct rb_node **p = &proc->nodes.rb_node;

struct rb_node *parent = NULL;

struct binder_node *node;

binder_uintptr_t ptr = fp ? fp->binder : 0;

binder_uintptr_t cookie = fp ? fp->cookie : 0;

__u32 flags = fp ? fp->flags : 0;

assert_spin_locked(&proc->inner_lock);

while (*p) {

parent = *p;

node = rb_entry(parent, struct binder_node, rb_node);

if (ptr < node->ptr)

p = &(*p)->rb_left;

else if (ptr > node->ptr)

p = &(*p)->rb_right;

else {

/*

* A matching node is already in

* the rb tree. Abandon the init

* and return it.

*/

binder_inc_node_tmpref_ilocked(node);

return node;

}

}

node = new_node;

binder_stats_created(BINDER_STAT_NODE);

node->tmp_refs++;

rb_link_node(&node->rb_node, parent, p);

rb_insert_color(&node->rb_node, &proc->nodes);

node->debug_id = atomic_inc_return(&binder_last_id);

node->proc = proc;

node->ptr = ptr;

node->cookie = cookie;

node->work.type = BINDER_WORK_NODE;

node->min_priority = flags & FLAT_BINDER_FLAG_PRIORITY_MASK;

node->accept_fds = !!(flags & FLAT_BINDER_FLAG_ACCEPTS_FDS);

node->txn_security_ctx = !!(flags & FLAT_BINDER_FLAG_TXN_SECURITY_CTX);

spin_lock_init(&node->lock);

INIT_LIST_HEAD(&node->work.entry);

INIT_LIST_HEAD(&node->async_todo);

binder_debug(BINDER_DEBUG_INTERNAL_REFS,

"%d:%d node %d u%016llx c%016llx created\n",

proc->pid, current->pid, node->debug_id,

(u64)node->ptr, (u64)node->cookie);

return node;

}

static struct binder_node *binder_new_node(struct binder_proc *proc,

struct flat_binder_object *fp)

{

struct binder_node *node;

struct binder_node *new_node = kzalloc_obj(*node);

if (!new_node)

return NULL;

binder_inner_proc_lock(proc);

node = binder_init_node_ilocked(proc, new_node, fp);

binder_inner_proc_unlock(proc);

if (node != new_node)

/*

* The node was already added by another thread

*/

kfree(new_node);

return node;

}

static void binder_free_node(struct binder_node *node)

{

kfree(node);

binder_stats_deleted(BINDER_STAT_NODE);

}

static int binder_inc_node_nilocked(struct binder_node *node, int strong,

int internal,

struct list_head *target_list)

{

struct binder_proc *proc = node->proc;

assert_spin_locked(&node->lock);

if (proc)

assert_spin_locked(&proc->inner_lock);

if (strong) {

if (internal) {

if (target_list == NULL &&

node->internal_strong_refs == 0 &&

!(node->proc &&

node == node->proc->context->binder_context_mgr_node &&

node->has_strong_ref)) {

pr_err("invalid inc strong node for %d\n",

node->debug_id);

return -EINVAL;

}

node->internal_strong_refs++;

} else

node->local_strong_refs++;

if (!node->has_strong_ref && target_list) {

struct binder_thread *thread = container_of(target_list,

struct binder_thread, todo);

binder_dequeue_work_ilocked(&node->work);

BUG_ON(&thread->todo != target_list);

binder_enqueue_deferred_thread_work_ilocked(thread,

&node->work);

}

} else {

if (!internal)

node->local_weak_refs++;

if (!node->has_weak_ref && target_list && list_empty(&node->work.entry))

binder_enqueue_work_ilocked(&node->work, target_list);

}

return 0;

}

static int binder_inc_node(struct binder_node *node, int strong, int internal,

struct list_head *target_list)

{

int ret;

binder_node_inner_lock(node);

ret = binder_inc_node_nilocked(node, strong, internal, target_list);

binder_node_inner_unlock(node);

return ret;

}

static bool binder_dec_node_nilocked(struct binder_node *node,

int strong, int internal)

{

struct binder_proc *proc = node->proc;

assert_spin_locked(&node->lock);

if (proc)

assert_spin_locked(&proc->inner_lock);

if (strong) {

if (internal)

node->internal_strong_refs--;

else

node->local_strong_refs--;

if (node->local_strong_refs || node->internal_strong_refs)

return false;

} else {

if (!internal)

node->local_weak_refs--;

if (node->local_weak_refs || node->tmp_refs ||

!hlist_empty(&node->refs))

return false;

}

if (proc && (node->has_strong_ref || node->has_weak_ref)) {

if (list_empty(&node->work.entry)) {

binder_enqueue_work_ilocked(&node->work, &proc->todo);

binder_wakeup_proc_ilocked(proc);

}

} else {

if (hlist_empty(&node->refs) && !node->local_strong_refs &&

!node->local_weak_refs && !node->tmp_refs) {

if (proc) {

binder_dequeue_work_ilocked(&node->work);

rb_erase(&node->rb_node, &proc->nodes);

binder_debug(BINDER_DEBUG_INTERNAL_REFS,

"refless node %d deleted\n",

node->debug_id);

} else {

BUG_ON(!list_empty(&node->work.entry));

spin_lock(&binder_dead_nodes_lock);

/*

* tmp_refs could have changed so

* check it again

*/

if (node->tmp_refs) {

spin_unlock(&binder_dead_nodes_lock);

return false;

}

hlist_del(&node->dead_node);

spin_unlock(&binder_dead_nodes_lock);

binder_debug(BINDER_DEBUG_INTERNAL_REFS,

"dead node %d deleted\n",

node->debug_id);

}

return true;

}

}

return false;

}

static void binder_dec_node(struct binder_node *node, int strong, int internal)

{

bool free_node;

binder_node_inner_lock(node);

free_node = binder_dec_node_nilocked(node, strong, internal);

binder_node_inner_unlock(node);

if (free_node)

binder_free_node(node);

}

static void binder_inc_node_tmpref_ilocked(struct binder_node *node)

{

/*

* No call to binder_inc_node() is needed since we

* don't need to inform userspace of any changes to

* tmp_refs

*/

node->tmp_refs++;

}

/**

* binder_inc_node_tmpref() - take a temporary reference on node

* @node: node to reference

*

* Take reference on node to prevent the node from being freed

* while referenced only by a local variable. The inner lock is

* needed to serialize with the node work on the queue (which

* isn't needed after the node is dead). If the node is dead

* (node->proc is NULL), use binder_dead_nodes_lock to protect

* node->tmp_refs against dead-node-only cases where the node

* lock cannot be acquired (eg traversing the dead node list to

* print nodes)

*/

static void binder_inc_node_tmpref(struct binder_node *node)

{

binder_node_lock(node);

if (node->proc)

binder_inner_proc_lock(node->proc);

else

spin_lock(&binder_dead_nodes_lock);

binder_inc_node_tmpref_ilocked(node);

if (node->proc)

binder_inner_proc_unlock(node->proc);

else

spin_unlock(&binder_dead_nodes_lock);

binder_node_unlock(node);

}

/**

* binder_dec_node_tmpref() - remove a temporary reference on node

* @node: node to reference

*

* Release temporary reference on node taken via binder_inc_node_tmpref()

*/

static void binder_dec_node_tmpref(struct binder_node *node)

{

bool free_node;

binder_node_inner_lock(node);

if (!node->proc)

spin_lock(&binder_dead_nodes_lock);

else

__acquire(&binder_dead_nodes_lock);

node->tmp_refs--;

BUG_ON(node->tmp_refs < 0);

if (!node->proc)

spin_unlock(&binder_dead_nodes_lock);

else