* [PATCH] ANDROID: binder: synchronize_rcu() when using POLLFREE.
@ 2018-02-16 8:47 Martijn Coenen
2018-02-16 8:49 ` Martijn Coenen
0 siblings, 1 reply; 2+ messages in thread
From: Martijn Coenen @ 2018-02-16 8:47 UTC (permalink / raw)
To: gregkh, john.stultz, tkjos, arve
Cc: devel, ebiggers, linux-kernel, maco, Martijn Coenen, dvyukov
To prevent races with ep_remove_waitqueue() removing the
waitqueue at the same time.
Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com
Signed-off-by: Martijn Coenen <maco@android.com>
Cc: stable <stable@vger.kernel.org> # 4.14+
---
drivers/android/binder.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 15e3d3c2260d..359220f87e1d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -4376,6 +4376,15 @@ static int binder_thread_release(struct binder_proc *proc,
binder_inner_proc_unlock(thread->proc);
+ /*
+ * This is needed to avoid races between wake_up_poll() above and
+ * and ep_remove_waitqueue() called for other reasons (eg the epoll file
+ * descriptor being closed); ep_remove_waitqueue() holds an RCU read
+ * lock, so we can be sure it's done after calling synchronize_rcu().
+ */
+ if (thread->looper & BINDER_LOOPER_STATE_POLL)
+ synchronize_rcu();
+
if (send_reply)
binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
binder_release_work(proc, &thread->todo);
--
2.16.1.291.g4437f3f132-goog
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] ANDROID: binder: synchronize_rcu() when using POLLFREE.
2018-02-16 8:47 [PATCH] ANDROID: binder: synchronize_rcu() when using POLLFREE Martijn Coenen
@ 2018-02-16 8:49 ` Martijn Coenen
0 siblings, 0 replies; 2+ messages in thread
From: Martijn Coenen @ 2018-02-16 8:49 UTC (permalink / raw)
To: Greg KH, John Stultz, Todd Kjos, Arve Hjønnevåg
Cc: open list:ANDROID DRIVERS, Eric Biggers, LKML, Martijn Coenen,
Martijn Coenen, Dmitry Vyukov
Greg,
This is for 4.14 LTS and 4.16.
Thanks,
Martijn
On Fri, Feb 16, 2018 at 9:47 AM, Martijn Coenen <maco@android.com> wrote:
> To prevent races with ep_remove_waitqueue() removing the
> waitqueue at the same time.
>
> Reported-by: syzbot+a2a3c4909716e271487e@syzkaller.appspotmail.com
> Signed-off-by: Martijn Coenen <maco@android.com>
> ---
> drivers/android/binder.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 15e3d3c2260d..359220f87e1d 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -4376,6 +4376,15 @@ static int binder_thread_release(struct binder_proc *proc,
>
> binder_inner_proc_unlock(thread->proc);
>
> + /*
> + * This is needed to avoid races between wake_up_poll() above and
> + * and ep_remove_waitqueue() called for other reasons (eg the epoll file
> + * descriptor being closed); ep_remove_waitqueue() holds an RCU read
> + * lock, so we can be sure it's done after calling synchronize_rcu().
> + */
> + if (thread->looper & BINDER_LOOPER_STATE_POLL)
> + synchronize_rcu();
> +
> if (send_reply)
> binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
> binder_release_work(proc, &thread->todo);
> --
> 2.16.1.291.g4437f3f132-goog
>
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-02-16 8:49 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-02-16 8:47 [PATCH] ANDROID: binder: synchronize_rcu() when using POLLFREE Martijn Coenen
2018-02-16 8:49 ` Martijn Coenen
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.