kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/android
History
Alice Ryhl d3cd3efadd binder: remove "invalid inc weak" check 
commit d90eeb8ecd upstream.

There are no scenarios where a weak increment is invalid on binder_node.
The only possible case where it could be invalid is if the kernel
delivers BR_DECREFS to the process that owns the node, and then
increments the weak refcount again, effectively "reviving" a dead node.

However, that is not possible: when the BR_DECREFS command is delivered,
the kernel removes and frees the binder_node. The fact that you were
able to call binder_inc_node_nilocked() implies that the node is not yet
destroyed, which implies that BR_DECREFS has not been delivered to
userspace, so incrementing the weak refcount is valid.

Note that it's currently possible to trigger this condition if the owner
calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes
BC_INCREFS on binder_ref instances to fail when they should not.

Cc: stable@vger.kernel.org
Fixes: 457b9a6f09 ("Staging: android: add binder driver")
Reported-by: Yu-Ting Tseng <yutingtseng@google.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-10-29 14:04:39 +01:00
..
binder.c binder: remove "invalid inc weak" check 2025-10-29 14:04:39 +01:00
binder_alloc.c binder: fix race between mmput() and do_exit() 2024-01-25 15:27:39 -08:00
binder_alloc.h binder: fix memory leak in binder_init() 2023-08-16 18:27:24 +02:00
binder_alloc_selftest.c Revert "android: binder: stop saving a pointer to the VMA" 2023-05-30 14:03:19 +01:00
binder_internal.h binder: fix max_thread type inconsistency 2024-05-25 16:21:34 +02:00
binder_trace.h Binder: add TF_UPDATE_TXN to replace outdated txn 2022-06-27 16:16:30 +02:00
binderfs.c binderfs: rework superblock destruction 2022-09-01 16:18:49 +02:00
Kconfig remove CONFIG_ANDROID 2022-07-01 10:41:09 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00