kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/android
History
Alice Ryhl 97a71d277e binder: remove "invalid inc weak" check 
commit d90eeb8ecd upstream.

There are no scenarios where a weak increment is invalid on binder_node.
The only possible case where it could be invalid is if the kernel
delivers BR_DECREFS to the process that owns the node, and then
increments the weak refcount again, effectively "reviving" a dead node.

However, that is not possible: when the BR_DECREFS command is delivered,
the kernel removes and frees the binder_node. The fact that you were
able to call binder_inc_node_nilocked() implies that the node is not yet
destroyed, which implies that BR_DECREFS has not been delivered to
userspace, so incrementing the weak refcount is valid.

Note that it's currently possible to trigger this condition if the owner
calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes
BC_INCREFS on binder_ref instances to fail when they should not.

Cc: stable@vger.kernel.org
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reported-by: Yu-Ting Tseng <yutingtseng@google.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-29 14:03:12 +01:00
..
binder.c binder: remove "invalid inc weak" check 2025-10-29 14:03:12 +01:00
binder_alloc.c binder: fix race between mmput() and do_exit() 2024-01-25 14:52:46 -08:00
binder_alloc.h binder: fix memory leak in binder_init() 2023-08-16 18:21:59 +02:00
binder_alloc_selftest.c Revert "android: binder: stop saving a pointer to the VMA" 2023-06-05 09:21:24 +02:00
binder_internal.h binder: fix max_thread type inconsistency 2024-05-25 16:20:18 +02:00
binder_trace.h binder: add trace at free transaction. 2020-11-11 08:20:44 +01:00
binderfs.c binder: fix redefinition of seq_file attributes 2022-08-17 14:23:50 +02:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00