projects/linux·blob uaccess-cleanups · refs

1409 lines · 37.2 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/* binder_alloc.c
3 *
4 * Android IPC Subsystem
5 *
6 * Copyright (C) 2007-2017 Google, Inc.
7 */
8
9#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10
11#include <linux/list.h>
12#include <linux/sched/mm.h>
13#include <linux/module.h>
14#include <linux/rtmutex.h>
15#include <linux/rbtree.h>
16#include <linux/seq_file.h>
17#include <linux/vmalloc.h>
18#include <linux/slab.h>
19#include <linux/sched.h>
20#include <linux/list_lru.h>
21#include <linux/ratelimit.h>
22#include <asm/cacheflush.h>
23#include <linux/uaccess.h>
24#include <linux/highmem.h>
25#include <linux/sizes.h>
26#include <kunit/visibility.h>
27#include "binder_alloc.h"
28#include "binder_trace.h"
29
30static struct list_lru binder_freelist;
31
32static DEFINE_MUTEX(binder_alloc_mmap_lock);
33
34enum {
35 BINDER_DEBUG_USER_ERROR = 1U << 0,
36 BINDER_DEBUG_OPEN_CLOSE = 1U << 1,
37 BINDER_DEBUG_BUFFER_ALLOC = 1U << 2,
38 BINDER_DEBUG_BUFFER_ALLOC_ASYNC = 1U << 3,
39};
40static uint32_t binder_alloc_debug_mask = BINDER_DEBUG_USER_ERROR;
41
42module_param_named(debug_mask, binder_alloc_debug_mask,
43 uint, 0644);
44
45#define binder_alloc_debug(mask, x...) \
46 do { \
47 if (binder_alloc_debug_mask & mask) \
48 pr_info_ratelimited(x); \
49 } while (0)
50
51static struct binder_buffer *binder_buffer_next(struct binder_buffer *buffer)
52{
53 return list_entry(buffer->entry.next, struct binder_buffer, entry);
54}
55
56static struct binder_buffer *binder_buffer_prev(struct binder_buffer *buffer)
57{
58 return list_entry(buffer->entry.prev, struct binder_buffer, entry);
59}
60
61VISIBLE_IF_KUNIT size_t binder_alloc_buffer_size(struct binder_alloc *alloc,
62 struct binder_buffer *buffer)
63{
64 if (list_is_last(&buffer->entry, &alloc->buffers))
65 return alloc->vm_start + alloc->buffer_size - buffer->user_data;
66 return binder_buffer_next(buffer)->user_data - buffer->user_data;
67}
68EXPORT_SYMBOL_IF_KUNIT(binder_alloc_buffer_size);
69
70static void binder_insert_free_buffer(struct binder_alloc *alloc,
71 struct binder_buffer *new_buffer)
72{
73 struct rb_node **p = &alloc->free_buffers.rb_node;
74 struct rb_node *parent = NULL;
75 struct binder_buffer *buffer;
76 size_t buffer_size;
77 size_t new_buffer_size;
78
79 BUG_ON(!new_buffer->free);
80
81 new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);
82
83 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
84 "%d: add free buffer, size %zd, at %p\n",
85 alloc->pid, new_buffer_size, new_buffer);
86
87 while (*p) {
88 parent = *p;
89 buffer = rb_entry(parent, struct binder_buffer, rb_node);
90 BUG_ON(!buffer->free);
91
92 buffer_size = binder_alloc_buffer_size(alloc, buffer);
93
94 if (new_buffer_size < buffer_size)
95 p = &parent->rb_left;
96 else
97 p = &parent->rb_right;
98 }
99 rb_link_node(&new_buffer->rb_node, parent, p);
100 rb_insert_color(&new_buffer->rb_node, &alloc->free_buffers);
101}
102
103static void binder_insert_allocated_buffer_locked(
104 struct binder_alloc *alloc, struct binder_buffer *new_buffer)
105{
106 struct rb_node **p = &alloc->allocated_buffers.rb_node;
107 struct rb_node *parent = NULL;
108 struct binder_buffer *buffer;
109
110 BUG_ON(new_buffer->free);
111
112 while (*p) {
113 parent = *p;
114 buffer = rb_entry(parent, struct binder_buffer, rb_node);
115 BUG_ON(buffer->free);
116
117 if (new_buffer->user_data < buffer->user_data)
118 p = &parent->rb_left;
119 else if (new_buffer->user_data > buffer->user_data)
120 p = &parent->rb_right;
121 else
122 BUG();
123 }
124 rb_link_node(&new_buffer->rb_node, parent, p);
125 rb_insert_color(&new_buffer->rb_node, &alloc->allocated_buffers);
126}
127
128static struct binder_buffer *binder_alloc_prepare_to_free_locked(
129 struct binder_alloc *alloc,
130 unsigned long user_ptr)
131{
132 struct rb_node *n = alloc->allocated_buffers.rb_node;
133 struct binder_buffer *buffer;
134
135 while (n) {
136 buffer = rb_entry(n, struct binder_buffer, rb_node);
137 BUG_ON(buffer->free);
138
139 if (user_ptr < buffer->user_data) {
140 n = n->rb_left;
141 } else if (user_ptr > buffer->user_data) {
142 n = n->rb_right;
143 } else {
144 /*
145 * Guard against user threads attempting to
146 * free the buffer when in use by kernel or
147 * after it's already been freed.
148 */
149 if (!buffer->allow_user_free)
150 return ERR_PTR(-EPERM);
151 buffer->allow_user_free = 0;
152 return buffer;
153 }
154 }
155 return NULL;
156}
157
158/**
159 * binder_alloc_prepare_to_free() - get buffer given user ptr
160 * @alloc: binder_alloc for this proc
161 * @user_ptr: User pointer to buffer data
162 *
163 * Validate userspace pointer to buffer data and return buffer corresponding to
164 * that user pointer. Search the rb tree for buffer that matches user data
165 * pointer.
166 *
167 * Return: Pointer to buffer or NULL
168 */
169struct binder_buffer *binder_alloc_prepare_to_free(struct binder_alloc *alloc,
170 unsigned long user_ptr)
171{
172 guard(mutex)(&alloc->mutex);
173 return binder_alloc_prepare_to_free_locked(alloc, user_ptr);
174}
175
176static inline void
177binder_set_installed_page(struct binder_alloc *alloc,
178 unsigned long index,
179 struct page *page)
180{
181 /* Pairs with acquire in binder_get_installed_page() */
182 smp_store_release(&alloc->pages[index], page);
183}
184
185static inline struct page *
186binder_get_installed_page(struct binder_alloc *alloc, unsigned long index)
187{
188 /* Pairs with release in binder_set_installed_page() */
189 return smp_load_acquire(&alloc->pages[index]);
190}
191
192static void binder_lru_freelist_add(struct binder_alloc *alloc,
193 unsigned long start, unsigned long end)
194{
195 unsigned long page_addr;
196 struct page *page;
197
198 trace_binder_update_page_range(alloc, false, start, end);
199
200 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
201 size_t index;
202 int ret;
203
204 index = (page_addr - alloc->vm_start) / PAGE_SIZE;
205 page = binder_get_installed_page(alloc, index);
206 if (!page)
207 continue;
208
209 trace_binder_free_lru_start(alloc, index);
210
211 ret = list_lru_add(alloc->freelist,
212 page_to_lru(page),
213 page_to_nid(page),
214 NULL);
215 WARN_ON(!ret);
216
217 trace_binder_free_lru_end(alloc, index);
218 }
219}
220
221static inline
222void binder_alloc_set_mapped(struct binder_alloc *alloc, bool state)
223{
224 /* pairs with smp_load_acquire in binder_alloc_is_mapped() */
225 smp_store_release(&alloc->mapped, state);
226}
227
228static inline bool binder_alloc_is_mapped(struct binder_alloc *alloc)
229{
230 /* pairs with smp_store_release in binder_alloc_set_mapped() */
231 return smp_load_acquire(&alloc->mapped);
232}
233
234static struct page *binder_page_lookup(struct binder_alloc *alloc,
235 unsigned long addr)
236{
237 struct mm_struct *mm = alloc->mm;
238 struct page *page;
239 long npages = 0;
240
241 /*
242 * Find an existing page in the remote mm. If missing,
243 * don't attempt to fault-in just propagate an error.
244 */
245 mmap_read_lock(mm);
246 if (binder_alloc_is_mapped(alloc))
247 npages = get_user_pages_remote(mm, addr, 1, FOLL_NOFAULT,
248 &page, NULL);
249 mmap_read_unlock(mm);
250
251 return npages > 0 ? page : NULL;
252}
253
254static int binder_page_insert(struct binder_alloc *alloc,
255 unsigned long addr,
256 struct page *page)
257{
258 struct mm_struct *mm = alloc->mm;
259 struct vm_area_struct *vma;
260 int ret = -ESRCH;
261
262 /* attempt per-vma lock first */
263 vma = lock_vma_under_rcu(mm, addr);
264 if (vma) {
265 if (binder_alloc_is_mapped(alloc))
266 ret = vm_insert_page(vma, addr, page);
267 vma_end_read(vma);
268 return ret;
269 }
270
271 /* fall back to mmap_lock */
272 mmap_read_lock(mm);
273 vma = vma_lookup(mm, addr);
274 if (vma && binder_alloc_is_mapped(alloc))
275 ret = vm_insert_page(vma, addr, page);
276 mmap_read_unlock(mm);
277
278 return ret;
279}
280
281static struct page *binder_page_alloc(struct binder_alloc *alloc,
282 unsigned long index)
283{
284 struct binder_shrinker_mdata *mdata;
285 struct page *page;
286
287 page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO);
288 if (!page)
289 return NULL;
290
291 /* allocate and install shrinker metadata under page->private */
292 mdata = kzalloc_obj(*mdata);
293 if (!mdata) {
294 __free_page(page);
295 return NULL;
296 }
297
298 mdata->alloc = alloc;
299 mdata->page_index = index;
300 INIT_LIST_HEAD(&mdata->lru);
301 set_page_private(page, (unsigned long)mdata);
302
303 return page;
304}
305
306static void binder_free_page(struct page *page)
307{
308 kfree((struct binder_shrinker_mdata *)page_private(page));
309 __free_page(page);
310}
311
312static int binder_install_single_page(struct binder_alloc *alloc,
313 unsigned long index,
314 unsigned long addr)
315{
316 struct page *page;
317 int ret;
318
319 if (!mmget_not_zero(alloc->mm))
320 return -ESRCH;
321
322 page = binder_page_alloc(alloc, index);
323 if (!page) {
324 ret = -ENOMEM;
325 goto out;
326 }
327
328 ret = binder_page_insert(alloc, addr, page);
329 switch (ret) {
330 case -EBUSY:
331 /*
332 * EBUSY is ok. Someone installed the pte first but the
333 * alloc->pages[index] has not been updated yet. Discard
334 * our page and look up the one already installed.
335 */
336 ret = 0;
337 binder_free_page(page);
338 page = binder_page_lookup(alloc, addr);
339 if (!page) {
340 pr_err("%d: failed to find page at offset %lx\n",
341 alloc->pid, addr - alloc->vm_start);
342 ret = -ESRCH;
343 break;
344 }
345 fallthrough;
346 case 0:
347 /* Mark page installation complete and safe to use */
348 binder_set_installed_page(alloc, index, page);
349 break;
350 default:
351 binder_free_page(page);
352 pr_err("%d: %s failed to insert page at offset %lx with %d\n",
353 alloc->pid, __func__, addr - alloc->vm_start, ret);
354 break;
355 }
356out:
357 mmput_async(alloc->mm);
358 return ret;
359}
360
361static int binder_install_buffer_pages(struct binder_alloc *alloc,
362 struct binder_buffer *buffer,
363 size_t size)
364{
365 unsigned long start, final;
366 unsigned long page_addr;
367
368 start = buffer->user_data & PAGE_MASK;
369 final = PAGE_ALIGN(buffer->user_data + size);
370
371 for (page_addr = start; page_addr < final; page_addr += PAGE_SIZE) {
372 unsigned long index;
373 int ret;
374
375 index = (page_addr - alloc->vm_start) / PAGE_SIZE;
376 if (binder_get_installed_page(alloc, index))
377 continue;
378
379 trace_binder_alloc_page_start(alloc, index);
380
381 ret = binder_install_single_page(alloc, index, page_addr);
382 if (ret)
383 return ret;
384
385 trace_binder_alloc_page_end(alloc, index);
386 }
387
388 return 0;
389}
390
391/* The range of pages should exclude those shared with other buffers */
392static void binder_lru_freelist_del(struct binder_alloc *alloc,
393 unsigned long start, unsigned long end)
394{
395 unsigned long page_addr;
396 struct page *page;
397
398 trace_binder_update_page_range(alloc, true, start, end);
399
400 for (page_addr = start; page_addr < end; page_addr += PAGE_SIZE) {
401 unsigned long index;
402 bool on_lru;
403
404 index = (page_addr - alloc->vm_start) / PAGE_SIZE;
405 page = binder_get_installed_page(alloc, index);
406
407 if (page) {
408 trace_binder_alloc_lru_start(alloc, index);
409
410 on_lru = list_lru_del(alloc->freelist,
411 page_to_lru(page),
412 page_to_nid(page),
413 NULL);
414 WARN_ON(!on_lru);
415
416 trace_binder_alloc_lru_end(alloc, index);
417 continue;
418 }
419
420 if (index + 1 > alloc->pages_high)
421 alloc->pages_high = index + 1;
422 }
423}
424
425static void debug_no_space_locked(struct binder_alloc *alloc)
426{
427 size_t largest_alloc_size = 0;
428 struct binder_buffer *buffer;
429 size_t allocated_buffers = 0;
430 size_t largest_free_size = 0;
431 size_t total_alloc_size = 0;
432 size_t total_free_size = 0;
433 size_t free_buffers = 0;
434 size_t buffer_size;
435 struct rb_node *n;
436
437 for (n = rb_first(&alloc->allocated_buffers); n; n = rb_next(n)) {
438 buffer = rb_entry(n, struct binder_buffer, rb_node);
439 buffer_size = binder_alloc_buffer_size(alloc, buffer);
440 allocated_buffers++;
441 total_alloc_size += buffer_size;
442 if (buffer_size > largest_alloc_size)
443 largest_alloc_size = buffer_size;
444 }
445
446 for (n = rb_first(&alloc->free_buffers); n; n = rb_next(n)) {
447 buffer = rb_entry(n, struct binder_buffer, rb_node);
448 buffer_size = binder_alloc_buffer_size(alloc, buffer);
449 free_buffers++;
450 total_free_size += buffer_size;
451 if (buffer_size > largest_free_size)
452 largest_free_size = buffer_size;
453 }
454
455 binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
456 "allocated: %zd (num: %zd largest: %zd), free: %zd (num: %zd largest: %zd)\n",
457 total_alloc_size, allocated_buffers,
458 largest_alloc_size, total_free_size,
459 free_buffers, largest_free_size);
460}
461
462static bool debug_low_async_space_locked(struct binder_alloc *alloc)
463{
464 /*
465 * Find the amount and size of buffers allocated by the current caller;
466 * The idea is that once we cross the threshold, whoever is responsible
467 * for the low async space is likely to try to send another async txn,
468 * and at some point we'll catch them in the act. This is more efficient
469 * than keeping a map per pid.
470 */
471 struct binder_buffer *buffer;
472 size_t total_alloc_size = 0;
473 int pid = current->tgid;
474 size_t num_buffers = 0;
475 struct rb_node *n;
476
477 /*
478 * Only start detecting spammers once we have less than 20% of async
479 * space left (which is less than 10% of total buffer size).
480 */
481 if (alloc->free_async_space >= alloc->buffer_size / 10) {
482 alloc->oneway_spam_detected = false;
483 return false;
484 }
485
486 for (n = rb_first(&alloc->allocated_buffers); n != NULL;
487 n = rb_next(n)) {
488 buffer = rb_entry(n, struct binder_buffer, rb_node);
489 if (buffer->pid != pid)
490 continue;
491 if (!buffer->async_transaction)
492 continue;
493 total_alloc_size += binder_alloc_buffer_size(alloc, buffer);
494 num_buffers++;
495 }
496
497 /*
498 * Warn if this pid has more than 50 transactions, or more than 50% of
499 * async space (which is 25% of total buffer size). Oneway spam is only
500 * detected when the threshold is exceeded.
501 */
502 if (num_buffers > 50 || total_alloc_size > alloc->buffer_size / 4) {
503 binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
504 "%d: pid %d spamming oneway? %zd buffers allocated for a total size of %zd\n",
505 alloc->pid, pid, num_buffers, total_alloc_size);
506 if (!alloc->oneway_spam_detected) {
507 alloc->oneway_spam_detected = true;
508 return true;
509 }
510 }
511 return false;
512}
513
514/* Callers preallocate @new_buffer, it is freed by this function if unused */
515static struct binder_buffer *binder_alloc_new_buf_locked(
516 struct binder_alloc *alloc,
517 struct binder_buffer *new_buffer,
518 size_t size,
519 int is_async)
520{
521 struct rb_node *n = alloc->free_buffers.rb_node;
522 struct rb_node *best_fit = NULL;
523 struct binder_buffer *buffer;
524 unsigned long next_used_page;
525 unsigned long curr_last_page;
526 size_t buffer_size;
527
528 if (is_async && alloc->free_async_space < size) {
529 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
530 "%d: binder_alloc_buf size %zd failed, no async space left\n",
531 alloc->pid, size);
532 buffer = ERR_PTR(-ENOSPC);
533 goto out;
534 }
535
536 while (n) {
537 buffer = rb_entry(n, struct binder_buffer, rb_node);
538 BUG_ON(!buffer->free);
539 buffer_size = binder_alloc_buffer_size(alloc, buffer);
540
541 if (size < buffer_size) {
542 best_fit = n;
543 n = n->rb_left;
544 } else if (size > buffer_size) {
545 n = n->rb_right;
546 } else {
547 best_fit = n;
548 break;
549 }
550 }
551
552 if (unlikely(!best_fit)) {
553 binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
554 "%d: binder_alloc_buf size %zd failed, no address space\n",
555 alloc->pid, size);
556 debug_no_space_locked(alloc);
557 buffer = ERR_PTR(-ENOSPC);
558 goto out;
559 }
560
561 if (buffer_size != size) {
562 /* Found an oversized buffer and needs to be split */
563 buffer = rb_entry(best_fit, struct binder_buffer, rb_node);
564 buffer_size = binder_alloc_buffer_size(alloc, buffer);
565
566 WARN_ON(n || buffer_size == size);
567 new_buffer->user_data = buffer->user_data + size;
568 list_add(&new_buffer->entry, &buffer->entry);
569 new_buffer->free = 1;
570 binder_insert_free_buffer(alloc, new_buffer);
571 new_buffer = NULL;
572 }
573
574 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
575 "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",
576 alloc->pid, size, buffer, buffer_size);
577
578 /*
579 * Now we remove the pages from the freelist. A clever calculation
580 * with buffer_size determines if the last page is shared with an
581 * adjacent in-use buffer. In such case, the page has been already
582 * removed from the freelist so we trim our range short.
583 */
584 next_used_page = (buffer->user_data + buffer_size) & PAGE_MASK;
585 curr_last_page = PAGE_ALIGN(buffer->user_data + size);
586 binder_lru_freelist_del(alloc, PAGE_ALIGN(buffer->user_data),
587 min(next_used_page, curr_last_page));
588
589 rb_erase(&buffer->rb_node, &alloc->free_buffers);
590 buffer->free = 0;
591 buffer->allow_user_free = 0;
592 binder_insert_allocated_buffer_locked(alloc, buffer);
593 buffer->async_transaction = is_async;
594 buffer->oneway_spam_suspect = false;
595 if (is_async) {
596 alloc->free_async_space -= size;
597 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
598 "%d: binder_alloc_buf size %zd async free %zd\n",
599 alloc->pid, size, alloc->free_async_space);
600 if (debug_low_async_space_locked(alloc))
601 buffer->oneway_spam_suspect = true;
602 }
603
604out:
605 /* Discard possibly unused new_buffer */
606 kfree(new_buffer);
607 return buffer;
608}
609
610/* Calculate the sanitized total size, returns 0 for invalid request */
611static inline size_t sanitized_size(size_t data_size,
612 size_t offsets_size,
613 size_t extra_buffers_size)
614{
615 size_t total, tmp;
616
617 /* Align to pointer size and check for overflows */
618 tmp = ALIGN(data_size, sizeof(void *)) +
619 ALIGN(offsets_size, sizeof(void *));
620 if (tmp < data_size || tmp < offsets_size)
621 return 0;
622 total = tmp + ALIGN(extra_buffers_size, sizeof(void *));
623 if (total < tmp || total < extra_buffers_size)
624 return 0;
625
626 /* Pad 0-sized buffers so they get a unique address */
627 total = max(total, sizeof(void *));
628
629 return total;
630}
631
632/**
633 * binder_alloc_new_buf() - Allocate a new binder buffer
634 * @alloc: binder_alloc for this proc
635 * @data_size: size of user data buffer
636 * @offsets_size: user specified buffer offset
637 * @extra_buffers_size: size of extra space for meta-data (eg, security context)
638 * @is_async: buffer for async transaction
639 *
640 * Allocate a new buffer given the requested sizes. Returns
641 * the kernel version of the buffer pointer. The size allocated
642 * is the sum of the three given sizes (each rounded up to
643 * pointer-sized boundary)
644 *
645 * Return: The allocated buffer or %ERR_PTR(-errno) if error
646 */
647struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
648 size_t data_size,
649 size_t offsets_size,
650 size_t extra_buffers_size,
651 int is_async)
652{
653 struct binder_buffer *buffer, *next;
654 size_t size;
655 int ret;
656
657 /* Check binder_alloc is fully initialized */
658 if (!binder_alloc_is_mapped(alloc)) {
659 binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
660 "%d: binder_alloc_buf, no vma\n",
661 alloc->pid);
662 return ERR_PTR(-ESRCH);
663 }
664
665 size = sanitized_size(data_size, offsets_size, extra_buffers_size);
666 if (unlikely(!size)) {
667 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
668 "%d: got transaction with invalid size %zd-%zd-%zd\n",
669 alloc->pid, data_size, offsets_size,
670 extra_buffers_size);
671 return ERR_PTR(-EINVAL);
672 }
673
674 /* Preallocate the next buffer */
675 next = kzalloc_obj(*next);
676 if (!next)
677 return ERR_PTR(-ENOMEM);
678
679 mutex_lock(&alloc->mutex);
680 buffer = binder_alloc_new_buf_locked(alloc, next, size, is_async);
681 if (IS_ERR(buffer)) {
682 mutex_unlock(&alloc->mutex);
683 goto out;
684 }
685
686 buffer->data_size = data_size;
687 buffer->offsets_size = offsets_size;
688 buffer->extra_buffers_size = extra_buffers_size;
689 buffer->pid = current->tgid;
690 mutex_unlock(&alloc->mutex);
691
692 ret = binder_install_buffer_pages(alloc, buffer, size);
693 if (ret) {
694 binder_alloc_free_buf(alloc, buffer);
695 buffer = ERR_PTR(ret);
696 }
697out:
698 return buffer;
699}
700EXPORT_SYMBOL_IF_KUNIT(binder_alloc_new_buf);
701
702static unsigned long buffer_start_page(struct binder_buffer *buffer)
703{
704 return buffer->user_data & PAGE_MASK;
705}
706
707static unsigned long prev_buffer_end_page(struct binder_buffer *buffer)
708{
709 return (buffer->user_data - 1) & PAGE_MASK;
710}
711
712static void binder_delete_free_buffer(struct binder_alloc *alloc,
713 struct binder_buffer *buffer)
714{
715 struct binder_buffer *prev, *next;
716
717 if (PAGE_ALIGNED(buffer->user_data))
718 goto skip_freelist;
719
720 BUG_ON(alloc->buffers.next == &buffer->entry);
721 prev = binder_buffer_prev(buffer);
722 BUG_ON(!prev->free);
723 if (prev_buffer_end_page(prev) == buffer_start_page(buffer))
724 goto skip_freelist;
725
726 if (!list_is_last(&buffer->entry, &alloc->buffers)) {
727 next = binder_buffer_next(buffer);
728 if (buffer_start_page(next) == buffer_start_page(buffer))
729 goto skip_freelist;
730 }
731
732 binder_lru_freelist_add(alloc, buffer_start_page(buffer),
733 buffer_start_page(buffer) + PAGE_SIZE);
734skip_freelist:
735 list_del(&buffer->entry);
736 kfree(buffer);
737}
738
739static void binder_free_buf_locked(struct binder_alloc *alloc,
740 struct binder_buffer *buffer)
741{
742 size_t size, buffer_size;
743
744 buffer_size = binder_alloc_buffer_size(alloc, buffer);
745
746 size = ALIGN(buffer->data_size, sizeof(void *)) +
747 ALIGN(buffer->offsets_size, sizeof(void *)) +
748 ALIGN(buffer->extra_buffers_size, sizeof(void *));
749
750 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
751 "%d: binder_free_buf %p size %zd buffer_size %zd\n",
752 alloc->pid, buffer, size, buffer_size);
753
754 BUG_ON(buffer->free);
755 BUG_ON(size > buffer_size);
756 BUG_ON(buffer->transaction != NULL);
757 BUG_ON(buffer->user_data < alloc->vm_start);
758 BUG_ON(buffer->user_data > alloc->vm_start + alloc->buffer_size);
759
760 if (buffer->async_transaction) {
761 alloc->free_async_space += buffer_size;
762 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
763 "%d: binder_free_buf size %zd async free %zd\n",
764 alloc->pid, size, alloc->free_async_space);
765 }
766
767 binder_lru_freelist_add(alloc, PAGE_ALIGN(buffer->user_data),
768 (buffer->user_data + buffer_size) & PAGE_MASK);
769
770 rb_erase(&buffer->rb_node, &alloc->allocated_buffers);
771 buffer->free = 1;
772 if (!list_is_last(&buffer->entry, &alloc->buffers)) {
773 struct binder_buffer *next = binder_buffer_next(buffer);
774
775 if (next->free) {
776 rb_erase(&next->rb_node, &alloc->free_buffers);
777 binder_delete_free_buffer(alloc, next);
778 }
779 }
780 if (alloc->buffers.next != &buffer->entry) {
781 struct binder_buffer *prev = binder_buffer_prev(buffer);
782
783 if (prev->free) {
784 binder_delete_free_buffer(alloc, buffer);
785 rb_erase(&prev->rb_node, &alloc->free_buffers);
786 buffer = prev;
787 }
788 }
789 binder_insert_free_buffer(alloc, buffer);
790}
791
792/**
793 * binder_alloc_get_page() - get kernel pointer for given buffer offset
794 * @alloc: binder_alloc for this proc
795 * @buffer: binder buffer to be accessed
796 * @buffer_offset: offset into @buffer data
797 * @pgoffp: address to copy final page offset to
798 *
799 * Lookup the struct page corresponding to the address
800 * at @buffer_offset into @buffer->user_data. If @pgoffp is not
801 * NULL, the byte-offset into the page is written there.
802 *
803 * The caller is responsible to ensure that the offset points
804 * to a valid address within the @buffer and that @buffer is
805 * not freeable by the user. Since it can't be freed, we are
806 * guaranteed that the corresponding elements of @alloc->pages[]
807 * cannot change.
808 *
809 * Return: struct page
810 */
811static struct page *binder_alloc_get_page(struct binder_alloc *alloc,
812 struct binder_buffer *buffer,
813 binder_size_t buffer_offset,
814 pgoff_t *pgoffp)
815{
816 binder_size_t buffer_space_offset = buffer_offset +
817 (buffer->user_data - alloc->vm_start);
818 pgoff_t pgoff = buffer_space_offset & ~PAGE_MASK;
819 size_t index = buffer_space_offset >> PAGE_SHIFT;
820
821 *pgoffp = pgoff;
822
823 return alloc->pages[index];
824}
825
826/**
827 * binder_alloc_clear_buf() - zero out buffer
828 * @alloc: binder_alloc for this proc
829 * @buffer: binder buffer to be cleared
830 *
831 * memset the given buffer to 0
832 */
833static void binder_alloc_clear_buf(struct binder_alloc *alloc,
834 struct binder_buffer *buffer)
835{
836 size_t bytes = binder_alloc_buffer_size(alloc, buffer);
837 binder_size_t buffer_offset = 0;
838
839 while (bytes) {
840 unsigned long size;
841 struct page *page;
842 pgoff_t pgoff;
843
844 page = binder_alloc_get_page(alloc, buffer,
845 buffer_offset, &pgoff);
846 size = min_t(size_t, bytes, PAGE_SIZE - pgoff);
847 memset_page(page, pgoff, 0, size);
848 bytes -= size;
849 buffer_offset += size;
850 }
851}
852
853/**
854 * binder_alloc_free_buf() - free a binder buffer
855 * @alloc: binder_alloc for this proc
856 * @buffer: kernel pointer to buffer
857 *
858 * Free the buffer allocated via binder_alloc_new_buf()
859 */
860void binder_alloc_free_buf(struct binder_alloc *alloc,
861 struct binder_buffer *buffer)
862{
863 /*
864 * We could eliminate the call to binder_alloc_clear_buf()
865 * from binder_alloc_deferred_release() by moving this to
866 * binder_free_buf_locked(). However, that could
867 * increase contention for the alloc mutex if clear_on_free
868 * is used frequently for large buffers. The mutex is not
869 * needed for correctness here.
870 */
871 if (buffer->clear_on_free) {
872 binder_alloc_clear_buf(alloc, buffer);
873 buffer->clear_on_free = false;
874 }
875 mutex_lock(&alloc->mutex);
876 binder_free_buf_locked(alloc, buffer);
877 mutex_unlock(&alloc->mutex);
878}
879EXPORT_SYMBOL_IF_KUNIT(binder_alloc_free_buf);
880
881/**
882 * binder_alloc_mmap_handler() - map virtual address space for proc
883 * @alloc: alloc structure for this proc
884 * @vma: vma passed to mmap()
885 *
886 * Called by binder_mmap() to initialize the space specified in
887 * vma for allocating binder buffers
888 *
889 * Return:
890 * 0 = success
891 * -EBUSY = address space already mapped
892 * -ENOMEM = failed to map memory to given address space
893 */
894int binder_alloc_mmap_handler(struct binder_alloc *alloc,
895 struct vm_area_struct *vma)
896{
897 struct binder_buffer *buffer;
898 const char *failure_string;
899 int ret;
900
901 if (unlikely(vma->vm_mm != alloc->mm)) {
902 ret = -EINVAL;
903 failure_string = "invalid vma->vm_mm";
904 goto err_invalid_mm;
905 }
906
907 mutex_lock(&binder_alloc_mmap_lock);
908 if (alloc->buffer_size) {
909 ret = -EBUSY;
910 failure_string = "already mapped";
911 goto err_already_mapped;
912 }
913 alloc->buffer_size = min_t(unsigned long, vma->vm_end - vma->vm_start,
914 SZ_4M);
915 mutex_unlock(&binder_alloc_mmap_lock);
916
917 alloc->vm_start = vma->vm_start;
918
919 alloc->pages = kvzalloc_objs(alloc->pages[0],
920 alloc->buffer_size / PAGE_SIZE);
921 if (!alloc->pages) {
922 ret = -ENOMEM;
923 failure_string = "alloc page array";
924 goto err_alloc_pages_failed;
925 }
926
927 buffer = kzalloc_obj(*buffer);
928 if (!buffer) {
929 ret = -ENOMEM;
930 failure_string = "alloc buffer struct";
931 goto err_alloc_buf_struct_failed;
932 }
933
934 buffer->user_data = alloc->vm_start;
935 list_add(&buffer->entry, &alloc->buffers);
936 buffer->free = 1;
937 binder_insert_free_buffer(alloc, buffer);
938 alloc->free_async_space = alloc->buffer_size / 2;
939
940 /* Signal binder_alloc is fully initialized */
941 binder_alloc_set_mapped(alloc, true);
942
943 return 0;
944
945err_alloc_buf_struct_failed:
946 kvfree(alloc->pages);
947 alloc->pages = NULL;
948err_alloc_pages_failed:
949 alloc->vm_start = 0;
950 mutex_lock(&binder_alloc_mmap_lock);
951 alloc->buffer_size = 0;
952err_already_mapped:
953 mutex_unlock(&binder_alloc_mmap_lock);
954err_invalid_mm:
955 binder_alloc_debug(BINDER_DEBUG_USER_ERROR,
956 "%s: %d %lx-%lx %s failed %d\n", __func__,
957 alloc->pid, vma->vm_start, vma->vm_end,
958 failure_string, ret);
959 return ret;
960}
961EXPORT_SYMBOL_IF_KUNIT(binder_alloc_mmap_handler);
962
963void binder_alloc_deferred_release(struct binder_alloc *alloc)
964{
965 struct rb_node *n;
966 int buffers, page_count;
967 struct binder_buffer *buffer;
968
969 buffers = 0;
970 mutex_lock(&alloc->mutex);
971 BUG_ON(alloc->mapped);
972
973 while ((n = rb_first(&alloc->allocated_buffers))) {
974 buffer = rb_entry(n, struct binder_buffer, rb_node);
975
976 /* Transaction should already have been freed */
977 BUG_ON(buffer->transaction);
978
979 if (buffer->clear_on_free) {
980 binder_alloc_clear_buf(alloc, buffer);
981 buffer->clear_on_free = false;
982 }
983 binder_free_buf_locked(alloc, buffer);
984 buffers++;
985 }
986
987 while (!list_empty(&alloc->buffers)) {
988 buffer = list_first_entry(&alloc->buffers,
989 struct binder_buffer, entry);
990 WARN_ON(!buffer->free);
991
992 list_del(&buffer->entry);
993 WARN_ON_ONCE(!list_empty(&alloc->buffers));
994 kfree(buffer);
995 }
996
997 page_count = 0;
998 if (alloc->pages) {
999 int i;
1000
1001 for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
1002 struct page *page;
1003 bool on_lru;
1004
1005 page = binder_get_installed_page(alloc, i);
1006 if (!page)
1007 continue;
1008
1009 on_lru = list_lru_del(alloc->freelist,
1010 page_to_lru(page),
1011 page_to_nid(page),
1012 NULL);
1013 binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
1014 "%s: %d: page %d %s\n",
1015 __func__, alloc->pid, i,
1016 on_lru ? "on lru" : "active");
1017 binder_free_page(page);
1018 page_count++;
1019 }
1020 }
1021 mutex_unlock(&alloc->mutex);
1022 kvfree(alloc->pages);
1023 if (alloc->mm)
1024 mmdrop(alloc->mm);
1025
1026 binder_alloc_debug(BINDER_DEBUG_OPEN_CLOSE,
1027 "%s: %d buffers %d, pages %d\n",
1028 __func__, alloc->pid, buffers, page_count);
1029}
1030EXPORT_SYMBOL_IF_KUNIT(binder_alloc_deferred_release);
1031
1032/**
1033 * binder_alloc_print_allocated() - print buffer info
1034 * @m: seq_file for output via seq_printf()
1035 * @alloc: binder_alloc for this proc
1036 *
1037 * Prints information about every buffer associated with
1038 * the binder_alloc state to the given seq_file
1039 */
1040void binder_alloc_print_allocated(struct seq_file *m,
1041 struct binder_alloc *alloc)
1042{
1043 struct binder_buffer *buffer;
1044 struct rb_node *n;
1045
1046 guard(mutex)(&alloc->mutex);
1047 for (n = rb_first(&alloc->allocated_buffers); n; n = rb_next(n)) {
1048 buffer = rb_entry(n, struct binder_buffer, rb_node);
1049 seq_printf(m, " buffer %d: %lx size %zd:%zd:%zd %s\n",
1050 buffer->debug_id,
1051 buffer->user_data - alloc->vm_start,
1052 buffer->data_size, buffer->offsets_size,
1053 buffer->extra_buffers_size,
1054 buffer->transaction ? "active" : "delivered");
1055 }
1056}
1057
1058/**
1059 * binder_alloc_print_pages() - print page usage
1060 * @m: seq_file for output via seq_printf()
1061 * @alloc: binder_alloc for this proc
1062 */
1063void binder_alloc_print_pages(struct seq_file *m,
1064 struct binder_alloc *alloc)
1065{
1066 struct page *page;
1067 int i;
1068 int active = 0;
1069 int lru = 0;
1070 int free = 0;
1071
1072 mutex_lock(&alloc->mutex);
1073 /*
1074 * Make sure the binder_alloc is fully initialized, otherwise we might
1075 * read inconsistent state.
1076 */
1077 if (binder_alloc_is_mapped(alloc)) {
1078 for (i = 0; i < alloc->buffer_size / PAGE_SIZE; i++) {
1079 page = binder_get_installed_page(alloc, i);
1080 if (!page)
1081 free++;
1082 else if (list_empty(page_to_lru(page)))
1083 active++;
1084 else
1085 lru++;
1086 }
1087 }
1088 mutex_unlock(&alloc->mutex);
1089 seq_printf(m, " pages: %d:%d:%d\n", active, lru, free);
1090 seq_printf(m, " pages high watermark: %zu\n", alloc->pages_high);
1091}
1092
1093/**
1094 * binder_alloc_get_allocated_count() - return count of buffers
1095 * @alloc: binder_alloc for this proc
1096 *
1097 * Return: count of allocated buffers
1098 */
1099int binder_alloc_get_allocated_count(struct binder_alloc *alloc)
1100{
1101 struct rb_node *n;
1102 int count = 0;
1103
1104 guard(mutex)(&alloc->mutex);
1105 for (n = rb_first(&alloc->allocated_buffers); n != NULL; n = rb_next(n))
1106 count++;
1107 return count;
1108}
1109
1110
1111/**
1112 * binder_alloc_vma_close() - invalidate address space
1113 * @alloc: binder_alloc for this proc
1114 *
1115 * Called from binder_vma_close() when releasing address space.
1116 * Clears alloc->mapped to prevent new incoming transactions from
1117 * allocating more buffers.
1118 */
1119void binder_alloc_vma_close(struct binder_alloc *alloc)
1120{
1121 binder_alloc_set_mapped(alloc, false);
1122}
1123EXPORT_SYMBOL_IF_KUNIT(binder_alloc_vma_close);
1124
1125/**
1126 * binder_alloc_free_page() - shrinker callback to free pages
1127 * @item: item to free
1128 * @lru: list_lru instance of the item
1129 * @cb_arg: callback argument
1130 *
1131 * Called from list_lru_walk() in binder_shrink_scan() to free
1132 * up pages when the system is under memory pressure.
1133 */
1134enum lru_status binder_alloc_free_page(struct list_head *item,
1135 struct list_lru_one *lru,
1136 void *cb_arg)
1137 __must_hold(&lru->lock)
1138{
1139 struct binder_shrinker_mdata *mdata = container_of(item, typeof(*mdata), lru);
1140 struct binder_alloc *alloc = mdata->alloc;
1141 struct mm_struct *mm = alloc->mm;
1142 struct vm_area_struct *vma;
1143 struct page *page_to_free;
1144 unsigned long page_addr;
1145 int mm_locked = 0;
1146 size_t index;
1147
1148 if (!mmget_not_zero(mm))
1149 goto err_mmget;
1150
1151 index = mdata->page_index;
1152 page_addr = alloc->vm_start + index * PAGE_SIZE;
1153
1154 /* attempt per-vma lock first */
1155 vma = lock_vma_under_rcu(mm, page_addr);
1156 if (!vma) {
1157 /* fall back to mmap_lock */
1158 if (!mmap_read_trylock(mm))
1159 goto err_mmap_read_lock_failed;
1160 mm_locked = 1;
1161 vma = vma_lookup(mm, page_addr);
1162 }
1163
1164 if (!mutex_trylock(&alloc->mutex))
1165 goto err_get_alloc_mutex_failed;
1166
1167 /*
1168 * Since a binder_alloc can only be mapped once, we ensure
1169 * the vma corresponds to this mapping by checking whether
1170 * the binder_alloc is still mapped.
1171 */
1172 if (vma && !binder_alloc_is_mapped(alloc))
1173 goto err_invalid_vma;
1174
1175 trace_binder_unmap_kernel_start(alloc, index);
1176
1177 page_to_free = alloc->pages[index];
1178 binder_set_installed_page(alloc, index, NULL);
1179
1180 trace_binder_unmap_kernel_end(alloc, index);
1181
1182 list_lru_isolate(lru, item);
1183 spin_unlock(&lru->lock);
1184
1185 if (vma) {
1186 trace_binder_unmap_user_start(alloc, index);
1187
1188 zap_vma_range(vma, page_addr, PAGE_SIZE);
1189
1190 trace_binder_unmap_user_end(alloc, index);
1191 }
1192
1193 mutex_unlock(&alloc->mutex);
1194 if (mm_locked)
1195 mmap_read_unlock(mm);
1196 else
1197 vma_end_read(vma);
1198 mmput_async(mm);
1199 binder_free_page(page_to_free);
1200
1201 return LRU_REMOVED_RETRY;
1202
1203err_invalid_vma:
1204 mutex_unlock(&alloc->mutex);
1205err_get_alloc_mutex_failed:
1206 if (mm_locked)
1207 mmap_read_unlock(mm);
1208 else
1209 vma_end_read(vma);
1210err_mmap_read_lock_failed:
1211 mmput_async(mm);
1212err_mmget:
1213 return LRU_SKIP;
1214}
1215EXPORT_SYMBOL_IF_KUNIT(binder_alloc_free_page);
1216
1217static unsigned long
1218binder_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
1219{
1220 return list_lru_count(&binder_freelist);
1221}
1222
1223static unsigned long
1224binder_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
1225{
1226 return list_lru_walk(&binder_freelist, binder_alloc_free_page,
1227 NULL, sc->nr_to_scan);
1228}
1229
1230static struct shrinker *binder_shrinker;
1231
1232VISIBLE_IF_KUNIT void __binder_alloc_init(struct binder_alloc *alloc,
1233 struct list_lru *freelist)
1234{
1235 alloc->pid = current->tgid;
1236 alloc->mm = current->mm;
1237 mmgrab(alloc->mm);
1238 mutex_init(&alloc->mutex);
1239 INIT_LIST_HEAD(&alloc->buffers);
1240 alloc->freelist = freelist;
1241}
1242EXPORT_SYMBOL_IF_KUNIT(__binder_alloc_init);
1243
1244/**
1245 * binder_alloc_init() - called by binder_open() for per-proc initialization
1246 * @alloc: binder_alloc for this proc
1247 *
1248 * Called from binder_open() to initialize binder_alloc fields for
1249 * new binder proc
1250 */
1251void binder_alloc_init(struct binder_alloc *alloc)
1252{
1253 __binder_alloc_init(alloc, &binder_freelist);
1254}
1255
1256int binder_alloc_shrinker_init(void)
1257{
1258 int ret;
1259
1260 ret = list_lru_init(&binder_freelist);
1261 if (ret)
1262 return ret;
1263
1264 binder_shrinker = shrinker_alloc(0, "android-binder");
1265 if (!binder_shrinker) {
1266 list_lru_destroy(&binder_freelist);
1267 return -ENOMEM;
1268 }
1269
1270 binder_shrinker->count_objects = binder_shrink_count;
1271 binder_shrinker->scan_objects = binder_shrink_scan;
1272
1273 shrinker_register(binder_shrinker);
1274
1275 return 0;
1276}
1277
1278void binder_alloc_shrinker_exit(void)
1279{
1280 shrinker_free(binder_shrinker);
1281 list_lru_destroy(&binder_freelist);
1282}
1283
1284/**
1285 * check_buffer() - verify that buffer/offset is safe to access
1286 * @alloc: binder_alloc for this proc
1287 * @buffer: binder buffer to be accessed
1288 * @offset: offset into @buffer data
1289 * @bytes: bytes to access from offset
1290 *
1291 * Check that the @offset/@bytes are within the size of the given
1292 * @buffer and that the buffer is currently active and not freeable.
1293 * Offsets must also be multiples of sizeof(u32). The kernel is
1294 * allowed to touch the buffer in two cases:
1295 *
1296 * 1) when the buffer is being created:
1297 * (buffer->free == 0 && buffer->allow_user_free == 0)
1298 * 2) when the buffer is being torn down:
1299 * (buffer->free == 0 && buffer->transaction == NULL).
1300 *
1301 * Return: true if the buffer is safe to access
1302 */
1303static inline bool check_buffer(struct binder_alloc *alloc,
1304 struct binder_buffer *buffer,
1305 binder_size_t offset, size_t bytes)
1306{
1307 size_t buffer_size = binder_alloc_buffer_size(alloc, buffer);
1308
1309 return buffer_size >= bytes &&
1310 offset <= buffer_size - bytes &&
1311 IS_ALIGNED(offset, sizeof(u32)) &&
1312 !buffer->free &&
1313 (!buffer->allow_user_free || !buffer->transaction);
1314}
1315
1316/**
1317 * binder_alloc_copy_user_to_buffer() - copy src user to tgt user
1318 * @alloc: binder_alloc for this proc
1319 * @buffer: binder buffer to be accessed
1320 * @buffer_offset: offset into @buffer data
1321 * @from: userspace pointer to source buffer
1322 * @bytes: bytes to copy
1323 *
1324 * Copy bytes from source userspace to target buffer.
1325 *
1326 * Return: bytes remaining to be copied
1327 */
1328unsigned long
1329binder_alloc_copy_user_to_buffer(struct binder_alloc *alloc,
1330 struct binder_buffer *buffer,
1331 binder_size_t buffer_offset,
1332 const void __user *from,
1333 size_t bytes)
1334{
1335 if (!check_buffer(alloc, buffer, buffer_offset, bytes))
1336 return bytes;
1337
1338 while (bytes) {
1339 unsigned long size;
1340 unsigned long ret;
1341 struct page *page;
1342 pgoff_t pgoff;
1343 void *kptr;
1344
1345 page = binder_alloc_get_page(alloc, buffer,
1346 buffer_offset, &pgoff);
1347 size = min_t(size_t, bytes, PAGE_SIZE - pgoff);
1348 kptr = kmap_local_page(page) + pgoff;
1349 ret = copy_from_user(kptr, from, size);
1350 kunmap_local(kptr);
1351 if (ret)
1352 return bytes - size + ret;
1353 bytes -= size;
1354 from += size;
1355 buffer_offset += size;
1356 }
1357 return 0;
1358}
1359
1360static int binder_alloc_do_buffer_copy(struct binder_alloc *alloc,
1361 bool to_buffer,
1362 struct binder_buffer *buffer,
1363 binder_size_t buffer_offset,
1364 void *ptr,
1365 size_t bytes)
1366{
1367 /* All copies must be 32-bit aligned and 32-bit size */
1368 if (!check_buffer(alloc, buffer, buffer_offset, bytes))
1369 return -EINVAL;
1370
1371 while (bytes) {
1372 unsigned long size;
1373 struct page *page;
1374 pgoff_t pgoff;
1375
1376 page = binder_alloc_get_page(alloc, buffer,
1377 buffer_offset, &pgoff);
1378 size = min_t(size_t, bytes, PAGE_SIZE - pgoff);
1379 if (to_buffer)
1380 memcpy_to_page(page, pgoff, ptr, size);
1381 else
1382 memcpy_from_page(ptr, page, pgoff, size);
1383 bytes -= size;
1384 pgoff = 0;
1385 ptr = ptr + size;
1386 buffer_offset += size;
1387 }
1388 return 0;
1389}
1390
1391int binder_alloc_copy_to_buffer(struct binder_alloc *alloc,
1392 struct binder_buffer *buffer,
1393 binder_size_t buffer_offset,
1394 void *src,
1395 size_t bytes)
1396{
1397 return binder_alloc_do_buffer_copy(alloc, true, buffer, buffer_offset,
1398 src, bytes);
1399}
1400
1401int binder_alloc_copy_from_buffer(struct binder_alloc *alloc,
1402 void *dest,
1403 struct binder_buffer *buffer,
1404 binder_size_t buffer_offset,
1405 size_t bytes)
1406{
1407 return binder_alloc_do_buffer_copy(alloc, false, buffer, buffer_offset,
1408 dest, bytes);
1409}