From: Todd Kjos <tkjos@google.com>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: gregkh@linuxfoundation.org, christian@brauner.io,
arve@android.com, jannh@google.com, devel@driverdev.osuosl.org,
linux-kernel@vger.kernel.org, maco@google.com,
joel@joelfernandes.org, kernel-team@android.com
Subject: Re: [PATCH] binder: don't detect sender/target during buffer cleanup
Date: Tue, 2 Nov 2021 08:12:35 -0700 [thread overview]
Message-ID: <CAHRSSEwz-J57rz3n7-fnzK6gyY66WmvuG6BT6XdG6jZB668CWw@mail.gmail.com> (raw)
In-Reply-To: <20211102132336.GG2794@kadam>
On Tue, Nov 2, 2021 at 6:24 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> On Fri, Oct 15, 2021 at 04:38:11PM -0700, Todd Kjos wrote:
> > When freeing txn buffers, binder_transaction_buffer_release()
> > attempts to detect whether the current context is the target by
> > comparing current->group_leader to proc->tsk. This is an unreliable
> > test. Instead explicitly pass an 'is_failure' boolean.
> >
> > Detecting the sender was being used as a way to tell if the
> > transaction failed to be sent. When cleaning up after
> > failing to send a transaction, there is no need to close
> > the fds associated with a BINDER_TYPE_FDA object. Now
> > 'is_failure' can be used to accurately detect this case.
> >
>
> It's really hard for me to understand what this bug looks like to the
> user? Is it a memory leak or do we free the wrong thing?
It is a difficult case to hit (impossible for "well-behaved"
processes), but it could result in file descriptors being closed when
they shouldn't be.
>
> regards,
> dan carpenter
>
> --
> To unsubscribe from this group and stop receiving emails from it, send an email to kernel-team+unsubscribe@android.com.
>
prev parent reply other threads:[~2021-11-02 15:12 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-15 23:38 [PATCH] binder: don't detect sender/target during buffer cleanup Todd Kjos
2021-10-18 10:35 ` Christian Brauner
2021-11-02 13:23 ` Dan Carpenter
2021-11-02 15:12 ` Todd Kjos [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHRSSEwz-J57rz3n7-fnzK6gyY66WmvuG6BT6XdG6jZB668CWw@mail.gmail.com \
--to=tkjos@google.com \
--cc=arve@android.com \
--cc=christian@brauner.io \
--cc=dan.carpenter@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=joel@joelfernandes.org \
--cc=kernel-team@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.