Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

binder: remove unneeded size check code

In binder_ioctl function, the legitimacy check of cmd size has been
done in switch-case code:
switch (cmd) {
case BINDER_WRITE_READ;//BINDER_WRITE_READ contains size info

So unneeded do size check in binder_ioctl and binder_ioctl_write_read
again.

In the following version of Google GKI:

Linux version 5.10.110-android12-9-00011-g2c814f559132-ab8969555

It seems that the compiler has made optimization and has not passed
cmd parameters to binder_ioctl_write_read:
<binder_ioctl+628>: mov w8, #0x6201 // #25089
<binder_ioctl+632>: movk w8, #0xc030, lsl #16
<binder_ioctl+636>: cmp w20, w8
<binder_ioctl+640>: b.ne 0xffffffda8aa97880 <binder_ioctl+3168>
<binder_ioctl+644>: mov x0, x23 //filp
<binder_ioctl+648>: mov x1, x27 //arg
<binder_ioctl+652>: mov x2, x22 //thread
<binder_ioctl+656>: bl 0xffffffda8aa9e6e4 <binder_ioctl_write_read>
<binder_ioctl+660>: mov w26, w0

Signed-off-by: Jiazi.Li <jiazi.li@transsion.com>
Acked-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20221115120351.2769-1-jiazi.li@transsion.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Jiazi.Li and committed by
Greg Kroah-Hartman
7feb35bc 5dc4c995

+2 -13
+2 -13
drivers/android/binder.c
··· 5006 5006 return 0; 5007 5007 } 5008 5008 5009 - static int binder_ioctl_write_read(struct file *filp, 5010 - unsigned int cmd, unsigned long arg, 5009 + static int binder_ioctl_write_read(struct file *filp, unsigned long arg, 5011 5010 struct binder_thread *thread) 5012 5011 { 5013 5012 int ret = 0; 5014 5013 struct binder_proc *proc = filp->private_data; 5015 - unsigned int size = _IOC_SIZE(cmd); 5016 5014 void __user *ubuf = (void __user *)arg; 5017 5015 struct binder_write_read bwr; 5018 5016 5019 - if (size != sizeof(struct binder_write_read)) { 5020 - ret = -EINVAL; 5021 - goto out; 5022 - } 5023 5017 if (copy_from_user(&bwr, ubuf, sizeof(bwr))) { 5024 5018 ret = -EFAULT; 5025 5019 goto out; ··· 5290 5296 int ret; 5291 5297 struct binder_proc *proc = filp->private_data; 5292 5298 struct binder_thread *thread; 5293 - unsigned int size = _IOC_SIZE(cmd); 5294 5299 void __user *ubuf = (void __user *)arg; 5295 5300 5296 5301 /*pr_info("binder_ioctl: %d:%d %x %lx\n", ··· 5311 5318 5312 5319 switch (cmd) { 5313 5320 case BINDER_WRITE_READ: 5314 - ret = binder_ioctl_write_read(filp, cmd, arg, thread); 5321 + ret = binder_ioctl_write_read(filp, arg, thread); 5315 5322 if (ret) 5316 5323 goto err; 5317 5324 break; ··· 5354 5361 case BINDER_VERSION: { 5355 5362 struct binder_version __user *ver = ubuf; 5356 5363 5357 - if (size != sizeof(struct binder_version)) { 5358 - ret = -EINVAL; 5359 - goto err; 5360 - } 5361 5364 if (put_user(BINDER_CURRENT_PROTOCOL_VERSION, 5362 5365 &ver->protocol_version)) { 5363 5366 ret = -EINVAL;