Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Alice Ryhl 885e34bd9b binder: remove "invalid inc weak" check ... commit d90eeb8ecd upstream. There are no scenarios where a weak increment is invalid on binder_node. The only possible case where it could be invalid is if the kernel delivers BR_DECREFS to the process that owns the node, and then increments the weak refcount again, effectively "reviving" a dead node. However, that is not possible: when the BR_DECREFS command is delivered, the kernel removes and frees the binder_node. The fact that you were able to call binder_inc_node_nilocked() implies that the node is not yet destroyed, which implies that BR_DECREFS has not been delivered to userspace, so incrementing the weak refcount is valid. Note that it's currently possible to trigger this condition if the owner calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes BC_INCREFS on binder_ref instances to fail when they should not. Cc: stable@vger.kernel.org Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reported-by: Yu-Ting Tseng <yutingtseng@google.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		History 2025-10-29 14:10:29 +01:00
..
tests	binder: Use seq_buf in binder_alloc kunit tests	2025-07-24 11:42:43 +02:00
binder.c	binder: remove "invalid inc weak" check	2025-10-29 14:10:29 +01:00
binder_alloc.c	binder: Convert binder_alloc selftests to KUnit	2025-07-16 14:11:59 +02:00
binder_alloc.h	binder: Convert binder_alloc selftests to KUnit	2025-07-16 14:11:59 +02:00
binder_internal.h	Char / Misc / IIO / other driver updates for 6.17-rc1	2025-07-29 09:52:01 -07:00
binder_trace.h	binder: Remove unused binder lock events	2025-06-24 17:23:59 +01:00
binderfs.c	Char / Misc / IIO / other driver updates for 6.17-rc1	2025-07-29 09:52:01 -07:00
dbitmap.h	binder: fix double-free in dbitmap	2025-10-12 13:01:56 +02:00
Kconfig	binder: Convert binder_alloc selftests to KUnit	2025-07-16 14:11:59 +02:00
Makefile	binder: Convert binder_alloc selftests to KUnit	2025-07-16 14:11:59 +02:00