Messages in this thread | | | From | Amit Pundir <> | Date | Mon, 11 Sep 2017 17:48:17 +0530 | Subject | Re: [PATCH] binder: fix memory corruption in binder_transaction binder |
| |
On 5 September 2017 at 22:51, Todd Kjos <tkjos@android.com> wrote: > From: Xu YiPing <xuyiping@hisilicon.com> > > commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are > safe") made a change to enqueue tcomplete to thread->todo before > enqueuing the transaction. However, in err_dead_proc_or_thread case, > the tcomplete is directly freed, without dequeued. It may cause the > thread->todo list to be corrupted. > > So, dequeue it before freeing.
I see Android boot loops with this patch on hikey tracking linux/master branch. 1st boot is fine but hikey runs into an unexpected short boot loops on 2nd and successive boots.
It takes about 3-4 iterations to finally come to sane state and boot to UI. I don't see this behaviour if I revert this patch.
Regards, Amit Pundir
> > Signed-off-by: Xu YiPing <xuyiping@hisilicon.com> > Signed-off-by: Todd Kjos <tkjos@google.com> > --- > drivers/android/binder.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/android/binder.c b/drivers/android/binder.c > index d055b3f2a207..96cc28afa383 100644 > --- a/drivers/android/binder.c > +++ b/drivers/android/binder.c > @@ -3083,6 +3083,7 @@ static void binder_transaction(struct binder_proc *proc, > err_dead_proc_or_thread: > return_error = BR_DEAD_REPLY; > return_error_line = __LINE__; > + binder_dequeue_work(proc, tcomplete); > err_translate_failed: > err_bad_object_type: > err_bad_offset: > -- > 2.14.1.581.gf28d330327-goog >
| |