linux-kernel - Re: [PATCH 02/37] binder: use group leader instead of open thread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANcMJZDkxZ+bOnT0Otzd+FJVmd8_+aQaMSn7=qh3ex3xwaQj1w@mail.gmail.com>
Date:   Mon, 24 Jul 2017 14:07:16 -0700
From:   John Stultz <john.stultz@...aro.org>
To:     Todd Kjos <tkjos@...roid.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Arve Hjønnevåg <arve@...roid.com>,
        devel@...verdev.osuosl.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Martijn Coenen <maco@...gle.com>, Todd Kjos <tkjos@...gle.com>
Subject: Re: [PATCH 02/37] binder: use group leader instead of open thread

On Mon, Jul 24, 2017 at 2:00 PM, John Stultz <john.stultz@...aro.org> wrote:
> On Thu, Jun 29, 2017 at 12:01 PM, Todd Kjos <tkjos@...roid.com> wrote:
>> The binder allocator assumes that the thread that
>> called binder_open will never die for the lifetime of
>> that proc. That thread is normally the group_leader,
>> however it may not be. Use the group_leader instead
>> of current.
>>
>> Signed-off-by: Todd Kjos <tkjos@...gle.com>
>> ---
>>  drivers/android/binder.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
>> index 157bd3e49ff4..9393924ae8e8 100644
>> --- a/drivers/android/binder.c
>> +++ b/drivers/android/binder.c
>> @@ -3460,8 +3460,8 @@ static int binder_open(struct inode *nodp, struct file *filp)
>>         proc = kzalloc(sizeof(*proc), GFP_KERNEL);
>>         if (proc == NULL)
>>                 return -ENOMEM;
>> -       get_task_struct(current);
>> -       proc->tsk = current;
>> +       get_task_struct(current->group_leader);
>> +       proc->tsk = current->group_leader;
>>         INIT_LIST_HEAD(&proc->todo);
>>         init_waitqueue_head(&proc->wait);
>>         proc->default_priority = task_nice(current);
>> --
>
> So this patch landed in 4.13-rc2 (c4ea41ba195d), and seems to be
> causing a regression for me w/ HiKey. With it, I'm getting crashes
> with the bluetooth and wifi HALs.  Reverting this patch seems to
> resolve the issue
>
> I suspect some other dependency from the original patchset is missing?

As for the crash, the logcat details show:

12-31 16:00:36.632  2518  2584 E hw-ProcessState: Using /dev/hwbinder
failed: unable to mmap transaction memory.
12-31 16:00:36.632  2518  2566 D bt_hci  : hci_module_start_up
starting async portion
12-31 16:00:36.632  2518  2584 E
android.hardware.bluetooth@1.0::BluetoothHci: getService:
defaultServiceManager()->getTransport returns
Status(EX_TRANSACTION_FAILED): '-9 Bad file descriptor: '
12-31 16:00:36.633  2518  2584 F         :
[1231/160036:FATAL:hci_layer_android.cc(109)] Check failed: btHci !=
nullptr.
12-31 16:00:36.634  2518  2584 F libc    : Fatal signal 6 (SIGABRT),
code -6 in tid 2584 (hci_thread)
...
12-31 16:00:38.027  2009  2061 E SupplicantStaIfaceHal: Exception
while trying to register a listener for ISupplicant service:
android.os.RemoteException: HwBinder Error: (-2147483648)
12-31 16:00:38.027  2009  2061 E WifiMonitor: startMonitoring(wlan0) failed!
12-31 16:00:38.028  2009  2061 E SupplicantStaIfaceHal: Can't call
setDebugParams, ISupplicant is null
12-31 16:00:38.030  2009  2061 D WifiConfigStore: Reading from stores
completed in 2 ms.
12-31 16:00:38.034  2009  2061 D WIFI    : Registering NetworkFactory
12-31 16:00:38.035  2009  2061 D WIFI_UT : Registering NetworkFactory
12-31 16:00:38.035  2009  2065 D ConnectivityService: Got
NetworkFactory Messenger for WIFI
12-31 16:00:38.035  2009  2065 D ConnectivityService: Got
NetworkFactory Messenger for WIFI_UT
12-31 16:00:38.037  2009  2061 D WifiConfigStore: Reading from user
store completed in 2 ms.
12-31 16:00:38.055  2009  2061 D WifiConfigStore: Writing to stores
completed in 17 ms.
12-31 16:00:38.055  2009  2061 E WifiStateMachine: Failed to setup
control channel, restart supplicant
...
etc.

thanks
-john