lkml.org 
[lkml]   [2017]   [Jun]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 14/37] binder: avoid race conditions when enqueuing txn
    Date
    Currently, the transaction complete work item is queued
    after the transaction. This means that it is possible
    for the transaction to be handled and a reply to be
    enqueued in the current thread before the transaction
    complete is enqueued, which violates the protocol
    with userspace who may not expect the transaction
    complete. Fixed by always enqueing the transaction
    complete first.

    Also, once the transaction is enqueued, it is unsafe
    to access since it might be freed. Currently,
    t->flags is accessed to determine whether a sync
    wake is needed. Changed to access tr->flags
    instead.

    Signed-off-by: Todd Kjos <tkjos@google.com>
    ---
    drivers/android/binder.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    index f17d1dfa5b02..71faf548482d 100644
    --- a/drivers/android/binder.c
    +++ b/drivers/android/binder.c
    @@ -1799,6 +1799,9 @@ static void binder_transaction(struct binder_proc *proc,
    goto err_bad_object_type;
    }
    }
    + tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
    + list_add_tail(&tcomplete->entry, &thread->todo);
    +
    if (reply) {
    BUG_ON(t->buffer->async_transaction != 0);
    binder_pop_transaction(target_thread, in_reply_to);
    @@ -1818,10 +1821,8 @@ static void binder_transaction(struct binder_proc *proc,
    }
    t->work.type = BINDER_WORK_TRANSACTION;
    list_add_tail(&t->work.entry, target_list);
    - tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
    - list_add_tail(&tcomplete->entry, &thread->todo);
    if (target_wait) {
    - if (reply || !(t->flags & TF_ONE_WAY))
    + if (reply || !(tr->flags & TF_ONE_WAY))
    wake_up_interruptible_sync(target_wait);
    else
    wake_up_interruptible(target_wait);
    --
    2.13.2.725.g09c95d1e9-goog
    \
     
     \ /
      Last update: 2017-06-29 21:11    [W:4.185 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site