Commit ccae6f67 authored Jun 29, 2017 by Todd Kjos Committed by Greg Kroah-Hartman Jul 17, 2017

binder: avoid race conditions when enqueuing txn



Currently, the transaction complete work item is queued
after the transaction. This means that it is possible
for the transaction to be handled and a reply to be
enqueued in the current thread before the transaction
complete is enqueued, which violates the protocol
with userspace who may not expect the transaction
complete. Fixed by always enqueing the transaction
complete first.

Also, once the transaction is enqueued, it is unsafe
to access since it might be freed. Currently,
t->flags is accessed to determine whether a sync
wake is needed. Changed to access tr->flags
instead.

Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 26b47d8a

drivers/android/binder.c

+4 −3

Original line number	Diff line number	Diff line
		@@ -1799,6 +1799,9 @@ static void binder_transaction(struct binder_proc *proc,
		goto err_bad_object_type;
		}
		}
		tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
		list_add_tail(&tcomplete->entry, &thread->todo);

		if (reply) {
		BUG_ON(t->buffer->async_transaction != 0);
		binder_pop_transaction(target_thread, in_reply_to);
		@@ -1818,10 +1821,8 @@ static void binder_transaction(struct binder_proc *proc,
		}
		t->work.type = BINDER_WORK_TRANSACTION;
		list_add_tail(&t->work.entry, target_list);
		tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
		list_add_tail(&tcomplete->entry, &thread->todo);
		if (target_wait) {
		if (reply \|\| !(t->flags & TF_ONE_WAY))
		if (reply \|\| !(tr->flags & TF_ONE_WAY))
		wake_up_interruptible_sync(target_wait);
		else
		wake_up_interruptible(target_wait);

Admin message