Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 35 additions & 34 deletions drivers/android/allocation.rs
Original file line number Diff line number Diff line change
Expand Up @@ -112,33 +112,6 @@ impl<'a> Allocation<'a> {
pub(crate) fn set_info(&mut self, info: AllocationInfo) {
self.allocation_info = Some(info);
}

fn cleanup_object(&self, index_offset: usize, view: &AllocationView) -> Result {
let offset = self.read(index_offset)?;
let header = view.read::<bindings::binder_object_header>(offset)?;
// TODO: Handle other types.
match header.type_ {
BINDER_TYPE_WEAK_BINDER | BINDER_TYPE_BINDER => {
let obj = view.read::<bindings::flat_binder_object>(offset)?;
let strong = header.type_ == BINDER_TYPE_BINDER;
// SAFETY: The type is `BINDER_TYPE_{WEAK_}BINDER`, so the `binder` field is
// populated.
let ptr = unsafe { obj.__bindgen_anon_1.binder } as usize;
let cookie = obj.cookie as usize;
self.process.update_node(ptr, cookie, strong, false);
Ok(())
}
BINDER_TYPE_WEAK_HANDLE | BINDER_TYPE_HANDLE => {
let obj = view.read::<bindings::flat_binder_object>(offset)?;
let strong = header.type_ == BINDER_TYPE_HANDLE;
// SAFETY: The type is `BINDER_TYPE_{WEAK_}HANDLE`, so the `handle` field is
// populated.
let handle = unsafe { obj.__bindgen_anon_1.handle } as _;
self.process.update_ref(handle, false, strong)
}
_ => Ok(()),
}
}
}

impl Drop for Allocation<'_> {
Expand All @@ -148,9 +121,10 @@ impl Drop for Allocation<'_> {
}

if let Some(info) = &self.allocation_info {
let view = AllocationView::new(self, info.offsets.start);
for i in info.offsets.clone().step_by(size_of::<usize>()) {
if self.cleanup_object(i, &view).is_err() {
let offsets = info.offsets.clone();
let view = AllocationView::new(self, offsets.start);
for i in offsets.step_by(size_of::<usize>()) {
if view.cleanup_object(i).is_err() {
pr_warn!("Error cleaning up object at offset {}\n", i)
}
}
Expand All @@ -160,13 +134,13 @@ impl Drop for Allocation<'_> {
}
}

pub(crate) struct AllocationView<'a> {
alloc: &'a Allocation<'a>,
pub(crate) struct AllocationView<'a, 'b> {
pub(crate) alloc: &'a mut Allocation<'b>,
limit: usize,
}

impl<'a> AllocationView<'a> {
pub(crate) fn new(alloc: &'a Allocation, limit: usize) -> Self {
impl<'a, 'b> AllocationView<'a, 'b> {
pub(crate) fn new(alloc: &'a mut Allocation<'b>, limit: usize) -> Self {
AllocationView { alloc, limit }
}

Expand Down Expand Up @@ -250,4 +224,31 @@ impl<'a> AllocationView<'a> {
}
Ok(())
}

fn cleanup_object(&self, index_offset: usize) -> Result {
let offset = self.alloc.read(index_offset)?;
let header = self.read::<bindings::binder_object_header>(offset)?;
// TODO: Handle other types.
match header.type_ {
BINDER_TYPE_WEAK_BINDER | BINDER_TYPE_BINDER => {
let obj = self.read::<bindings::flat_binder_object>(offset)?;
let strong = header.type_ == BINDER_TYPE_BINDER;
// SAFETY: The type is `BINDER_TYPE_{WEAK_}BINDER`, so the `binder` field is
// populated.
let ptr = unsafe { obj.__bindgen_anon_1.binder } as usize;
let cookie = obj.cookie as usize;
self.alloc.process.update_node(ptr, cookie, strong, false);
Ok(())
}
BINDER_TYPE_WEAK_HANDLE | BINDER_TYPE_HANDLE => {
let obj = self.read::<bindings::flat_binder_object>(offset)?;
let strong = header.type_ == BINDER_TYPE_HANDLE;
// SAFETY: The type is `BINDER_TYPE_{WEAK_}HANDLE`, so the `handle` field is
// populated.
let handle = unsafe { obj.__bindgen_anon_1.handle } as _;
self.alloc.process.update_ref(handle, false, strong)
}
_ => Ok(()),
}
}
}
7 changes: 3 additions & 4 deletions drivers/android/thread.rs
Original file line number Diff line number Diff line change
Expand Up @@ -376,11 +376,10 @@ impl Thread {
fn translate_object(
&self,
index_offset: usize,
alloc: &Allocation,
view: &AllocationView,
allow_fds: bool,
) -> BinderResult {
let offset = alloc.read(index_offset)?;
let offset = view.alloc.read(index_offset)?;
let header = view.read::<bindings::binder_object_header>(offset)?;
// TODO: Handle other types.
match header.type_ {
Expand Down Expand Up @@ -421,9 +420,9 @@ impl Thread {
end: usize,
allow_fds: bool,
) -> BinderResult {
let view = AllocationView::new(&alloc, start);
let view = AllocationView::new(alloc, start);
for i in (start..end).step_by(size_of::<usize>()) {
if let Err(err) = self.translate_object(i, alloc, &view, allow_fds) {
if let Err(err) = self.translate_object(i, &view, allow_fds) {
alloc.set_info(AllocationInfo { offsets: start..i });
return Err(err);
}
Expand Down