staging: android: binder: Add deref_helper() macro

This patch adds a deref_helper() macro that will be used to dereference
the binder offsets on 64bit systems where the offset is either a 32bit
or a 64bit value, depending on the userpace used (32bit /64bit)

This patch is a temporary patch that will be extended with 32bit compat
handling.

Signed-off-by: Serban Constantinescu <serban.constantinescu@arm.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>

diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c
index 8a4e252ece9e41e3a7981bfaab23ee44f2804898..38d47f1fee3745e225e199e690343870a734f0b5 100644 (file)
--- a/drivers/staging/android/binder.c
+++ b/drivers/staging/android/binder.c
@@ -142,6 +142,7 @@ module_param_call(stop_on_user_error, binder_set_stop_on_user_error,
        } while (0)
 
 #define align_helper(ptr)          ALIGN(ptr, sizeof(void *))
+#define deref_helper(ptr)          (*(typeof(size_t *))ptr)
 
 enum binder_stat_types {
        BINDER_STAT_PROC,
@@ -1231,7 +1232,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                                              struct binder_buffer *buffer,
                                              size_t *failed_at)
 {
-       size_t *offp, *off_end;
+       void *offp, *off_end;
        int debug_id = buffer->debug_id;
 
        binder_debug(BINDER_DEBUG_TRANSACTION,
@@ -1247,16 +1248,16 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                off_end = failed_at;
        else
                off_end = (void *)offp + buffer->offsets_size;
-       for (; offp < off_end; offp++) {
+       for (; offp < off_end; offp += sizeof(size_t)) {
                struct flat_binder_object *fp;
-               if (*offp > buffer->data_size - sizeof(*fp) ||
+               if (deref_helper(offp) > buffer->data_size - sizeof(*fp) ||
                    buffer->data_size < sizeof(*fp) ||
-                   !IS_ALIGNED(*offp, sizeof(u32))) {
+                   !IS_ALIGNED(deref_helper(offp), sizeof(u32))) {
                        pr_err("transaction release %d bad offset %zd, size %zd\n",
-                        debug_id, *offp, buffer->data_size);
+                        debug_id, deref_helper(offp), buffer->data_size);
                        continue;
                }
-               fp = (struct flat_binder_object *)(buffer->data + *offp);
+               fp = (struct flat_binder_object *)(buffer->data + deref_helper(offp));
                switch (fp->type) {
                case BINDER_TYPE_BINDER:
                case BINDER_TYPE_WEAK_BINDER: {
@@ -1306,7 +1307,7 @@ static void binder_transaction(struct binder_proc *proc,
 {
        struct binder_transaction *t;
        struct binder_work *tcomplete;
-       size_t *offp, *off_end;
+       void *offp, *off_end;
        struct binder_proc *target_proc;
        struct binder_thread *target_thread = NULL;
        struct binder_node *target_node = NULL;
@@ -1500,17 +1501,17 @@ static void binder_transaction(struct binder_proc *proc,
                goto err_bad_offset;
        }
        off_end = (void *)offp + tr->offsets_size;
-       for (; offp < off_end; offp++) {
+       for (; offp < off_end; offp += sizeof(size_t)) {
                struct flat_binder_object *fp;
-               if (*offp > t->buffer->data_size - sizeof(*fp) ||
+               if (deref_helper(offp) > t->buffer->data_size - sizeof(*fp) ||
                    t->buffer->data_size < sizeof(*fp) ||
-                   !IS_ALIGNED(*offp, sizeof(u32))) {
+                   !IS_ALIGNED(deref_helper(offp), sizeof(u32))) {
                        binder_user_error("%d:%d got transaction with invalid offset, %zd\n",
-                                       proc->pid, thread->pid, *offp);
+                                       proc->pid, thread->pid, deref_helper(offp));
                        return_error = BR_FAILED_REPLY;
                        goto err_bad_offset;
                }
-               fp = (struct flat_binder_object *)(t->buffer->data + *offp);
+               fp = (struct flat_binder_object *)(t->buffer->data + deref_helper(offp));
                switch (fp->type) {
                case BINDER_TYPE_BINDER:
                case BINDER_TYPE_WEAK_BINDER: {