linux-kernel - [PATCH RFC 0/0] drivers: android: binder crash issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Sun,  6 Sep 2015 17:00:25 +0100
From:	Victor Chong <victor.chong@...aro.org>
To:	gregkh@...uxfoundation.org, arve@...roid.com,
	riandrews@...roid.com, devel@...verdev.osuosl.org,
	linux-kernel@...r.kernel.org
Cc:	Puck Chen <puck.chen@...ilicon.com>,
	Victor Chong <victor.chong@...aro.org>
Subject: [PATCH RFC 0/0] drivers: android: binder crash issue

From: Puck Chen <puck.chen@...ilicon.com>

We find that the binder aborts when doing some asynchronous
transferring, e.g. when a phone call comes in.

If there are asynchronous requests in binder system, and new
requests coming, the asynchronous requests may insert into the
new requests queue.

In this scene, the asynchronous request will affect the
corresponding order of the new requests.

So we think that the asynchronous requests should be added to proc
struct instead of thread’s todo list.

Please let me know, if some things wrong in my opinion.

Signed-off-by: Victor Chong <victor.chong@...aro.org>
---
 drivers/android/binder.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 6607f3c..db4a0b5 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1922,7 +1922,7 @@ static int binder_thread_write(struct binder_proc *proc,
 				if (list_empty(&buffer->target_node->async_todo))
 					buffer->target_node->has_async_transaction = 0;
 				else
-					list_move_tail(buffer->target_node->async_todo.next, &thread->todo);
+					list_move_tail(buffer->target_node->async_todo.next, &proc->todo);
 			}
 			trace_binder_transaction_buffer_release(buffer);
 			binder_transaction_buffer_release(proc, buffer, NULL);
--
1.9.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/