diff options
| author | Alice Ryhl <aliceryhl@google.com> | 2025-10-15 14:26:55 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-29 14:09:00 +0100 |
| commit | 352745fe3b2b76c7a558a5d242f6f263da84646f (patch) | |
| tree | e0faaa1df88c079b3142646dd0d4a71f8ef793cf /drivers/android | |
| parent | e1e9175a3c6c534e76603a7caf4185dfe2c2dc12 (diff) | |
| download | linux-352745fe3b2b76c7a558a5d242f6f263da84646f.tar.gz linux-352745fe3b2b76c7a558a5d242f6f263da84646f.tar.bz2 linux-352745fe3b2b76c7a558a5d242f6f263da84646f.zip | |
binder: remove "invalid inc weak" check
commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream.
There are no scenarios where a weak increment is invalid on binder_node.
The only possible case where it could be invalid is if the kernel
delivers BR_DECREFS to the process that owns the node, and then
increments the weak refcount again, effectively "reviving" a dead node.
However, that is not possible: when the BR_DECREFS command is delivered,
the kernel removes and frees the binder_node. The fact that you were
able to call binder_inc_node_nilocked() implies that the node is not yet
destroyed, which implies that BR_DECREFS has not been delivered to
userspace, so incrementing the weak refcount is valid.
Note that it's currently possible to trigger this condition if the owner
calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes
BC_INCREFS on binder_ref instances to fail when they should not.
Cc: stable@vger.kernel.org
Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Reported-by: Yu-Ting Tseng <yutingtseng@google.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/android')
| -rw-r--r-- | drivers/android/binder.c | 11 |
1 files changed, 1 insertions, 10 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c index bdf09e8b898d..186c182fd656 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -846,17 +846,8 @@ static int binder_inc_node_nilocked(struct binder_node *node, int strong, } else { if (!internal) node->local_weak_refs++; - if (!node->has_weak_ref && list_empty(&node->work.entry)) { - if (target_list == NULL) { - pr_err("invalid inc weak node for %d\n", - node->debug_id); - return -EINVAL; - } - /* - * See comment above - */ + if (!node->has_weak_ref && target_list && list_empty(&node->work.entry)) binder_enqueue_work_ilocked(&node->work, target_list); - } } return 0; } |