* [PATCH] ANDROID: binder: fix transaction leak.
@ 2017-11-13 9:06 Martijn Coenen
2017-11-13 9:49 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Martijn Coenen @ 2017-11-13 9:06 UTC (permalink / raw)
To: gregkh, john.stultz, tkjos, arve, amit.pundir
Cc: linux-kernel, devel, maco, Martijn Coenen
If a call to put_user() fails, we failed to
properly free a transaction and send a failed
reply (if necessary).
Signed-off-by: Martijn Coenen <maco@android.com>
---
drivers/android/binder.c | 40 +++++++++++++++++++++++++++++++---------
1 file changed, 31 insertions(+), 9 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 95a96a254e5d..e947b09607ed 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1947,6 +1947,26 @@ static void binder_send_failed_reply(struct binder_transaction *t,
}
}
+/**
+ * binder_cleanup_transaction() - cleans up undelivered transaction
+ * @t: transaction that needs to be cleaned up
+ * @reason: reason the transaction wasn't delivered
+ * @error_code: error to return to caller (if synchronous call)
+ */
+static void binder_cleanup_transaction(struct binder_transaction *t,
+ const char *reason,
+ uint32_t error_code)
+{
+ if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
+ binder_send_failed_reply(t, error_code);
+ } else {
+ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+ "undelivered transaction %d, %s\n",
+ t->debug_id, reason);
+ binder_free_transaction(t);
+ }
+}
+
/**
* binder_validate_object() - checks for a valid metadata object in a buffer.
* @buffer: binder_buffer that we're parsing.
@@ -4015,12 +4035,20 @@ static int binder_thread_read(struct binder_proc *proc,
if (put_user(cmd, (uint32_t __user *)ptr)) {
if (t_from)
binder_thread_dec_tmpref(t_from);
+
+ binder_cleanup_transaction(t, "put_user failed",
+ BR_FAILED_REPLY);
+
return -EFAULT;
}
ptr += sizeof(uint32_t);
if (copy_to_user(ptr, &tr, sizeof(tr))) {
if (t_from)
binder_thread_dec_tmpref(t_from);
+
+ binder_cleanup_transaction(t, "copy_to_user failed",
+ BR_FAILED_REPLY);
+
return -EFAULT;
}
ptr += sizeof(tr);
@@ -4090,15 +4118,9 @@ static void binder_release_work(struct binder_proc *proc,
struct binder_transaction *t;
t = container_of(w, struct binder_transaction, work);
- if (t->buffer->target_node &&
- !(t->flags & TF_ONE_WAY)) {
- binder_send_failed_reply(t, BR_DEAD_REPLY);
- } else {
- binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
- "undelivered transaction %d\n",
- t->debug_id);
- binder_free_transaction(t);
- }
+
+ binder_cleanup_transaction(t, "process died.",
+ BR_DEAD_REPLY);
} break;
case BINDER_WORK_RETURN_ERROR: {
struct binder_error *e = container_of(
--
2.15.0.448.gf294e3d99a-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ANDROID: binder: fix transaction leak.
2017-11-13 9:06 [PATCH] ANDROID: binder: fix transaction leak Martijn Coenen
@ 2017-11-13 9:49 ` Greg KH
2017-11-13 9:54 ` Martijn Coenen
0 siblings, 1 reply; 3+ messages in thread
From: Greg KH @ 2017-11-13 9:49 UTC (permalink / raw)
To: Martijn Coenen
Cc: john.stultz, tkjos, arve, amit.pundir, devel, maco, linux-kernel
On Mon, Nov 13, 2017 at 10:06:08AM +0100, Martijn Coenen wrote:
> If a call to put_user() fails, we failed to
> properly free a transaction and send a failed
> reply (if necessary).
>
> Signed-off-by: Martijn Coenen <maco@android.com>
> ---
> drivers/android/binder.c | 40 +++++++++++++++++++++++++++++++---------
> 1 file changed, 31 insertions(+), 9 deletions(-)
Is this relevant for 4.14 and any older kernels as well?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ANDROID: binder: fix transaction leak.
2017-11-13 9:49 ` Greg KH
@ 2017-11-13 9:54 ` Martijn Coenen
0 siblings, 0 replies; 3+ messages in thread
From: Martijn Coenen @ 2017-11-13 9:54 UTC (permalink / raw)
To: Greg KH
Cc: John Stultz, Todd Kjos, Arve Hjønnevåg, Amit Pundir,
devel, Martijn Coenen, LKML
On Mon, Nov 13, 2017 at 10:49 AM, Greg KH <gregkh@linuxfoundation.org> wrote:
> Is this relevant for 4.14 and any older kernels as well?
The problem was introduced with fine-grained locking, which is 4.14 and up only.
Thanks,
Martijn
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-11-13 9:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-11-13 9:06 [PATCH] ANDROID: binder: fix transaction leak Martijn Coenen
2017-11-13 9:49 ` Greg KH
2017-11-13 9:54 ` Martijn Coenen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.