Received: by 10.223.185.116 with SMTP id b49csp1079352wrg; Fri, 23 Feb 2018 11:32:39 -0800 (PST) X-Google-Smtp-Source: AH8x2262zRMpoB/ycf0e1ij7Hs05H3nvHbERG0Sb/8nZmXf68QVt+SJ3zqdA7HcErC0IIckd4WpX X-Received: by 10.98.89.156 with SMTP id k28mr2752485pfj.130.1519414359050; Fri, 23 Feb 2018 11:32:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519414359; cv=none; d=google.com; s=arc-20160816; b=vJH4TO7MonNqAQEXF/xv+WkvjO2CvVCAZayfafrKSaAitZgwFppzhTHfAQdP7E5vRk a56BBindB0uMKObRExwJ2Pkhi5PuWEpuSFOzZhrlJ3lH40nNijKq5vlvEYEIxcdS8/PA CA3qp7MW7bsZ5zhfa86RsqJGOXbgsuzjEhnXyd8eWnuGs8PkA/tjRJqdamgkNp6Hp9TL XaOKRabcI128D+dLJxdskSs604iC+no8WyfKF0MnolqZPFEmWs9wRLC9QyLZDjgzXQSQ WOYT5Spb1wvi+y4SIBCsxIXnmmIKaL1FV6W+70vUaWzM/YTAPoHXfUe6hyBaryaJlVea Jl1g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=JcBERBTxtQn6jmZe4Nwb9oRx7NLyVsLTHsKc8PBjSlU=; b=piE9Cz8bBtV1I2JkoreyvzUQqS5K68nsJMSZTKvJSQAGDsgjFGnI+0+qKe5qLHlC2Y l3WbUaNY/k3e2GhgfB/x2E3UU+NyBHwIkdvxbZIu/ViwM33mw0UvQxLGa3YuqJBCKc2z nKnpdHGOk7/SUgzzU2obDn7F0Y2NdqdYgDDTi5Dp8x1n9KZ64Gr7NUcerWjQLslpIhVH LzOqGjg2LwIIQ/QdJLAN9zg1Qut8/pGoL0UbvAb08Wz443On3lxG8CrtCSff/DBgBik+ c+1Lvc9G6uYJbk3ydmzENH2NHwCPzgDJDP3sZR2uroQ15w7LXc5HttbAhYh39wx9pnTO wYFw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id n3-v6si2186389plb.817.2018.02.23.11.32.24; Fri, 23 Feb 2018 11:32:39 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934961AbeBWSv1 (ORCPT + 99 others); Fri, 23 Feb 2018 13:51:27 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:46010 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934552AbeBWSvY (ORCPT ); Fri, 23 Feb 2018 13:51:24 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 6FC6812E2; Fri, 23 Feb 2018 18:51:23 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Todd Kjos , syzbot Subject: [PATCH 4.14 050/159] ANDROID: binder: remove WARN() for redundant txn error Date: Fri, 23 Feb 2018 19:25:58 +0100 Message-Id: <20180223170749.576977751@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170743.086611315@linuxfoundation.org> References: <20180223170743.086611315@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Todd Kjos commit e46a3b3ba7509cb7fda0e07bc7c63a2cd90f579b upstream. binder_send_failed_reply() is called when a synchronous transaction fails. It reports an error to the thread that is waiting for the completion. Given that the transaction is synchronous, there should never be more than 1 error response to that thread -- this was being asserted with a WARN(). However, when exercising the driver with syzbot tests, cases were observed where multiple "synchronous" requests were sent without waiting for responses, so it is possible that multiple errors would be reported to the thread. This testing was conducted with panic_on_warn set which forced the crash. This is easily reproduced by sending back-to-back "synchronous" transactions without checking for any response (eg, set read_size to 0): bwr.write_buffer = (uintptr_t)&bc1; bwr.write_size = sizeof(bc1); bwr.read_buffer = (uintptr_t)&br; bwr.read_size = 0; ioctl(fd, BINDER_WRITE_READ, &bwr); sleep(1); bwr2.write_buffer = (uintptr_t)&bc2; bwr2.write_size = sizeof(bc2); bwr2.read_buffer = (uintptr_t)&br; bwr2.read_size = 0; ioctl(fd, BINDER_WRITE_READ, &bwr2); sleep(1); The first transaction is sent to the servicemanager and the reply fails because no VMA is set up by this client. After binder_send_failed_reply() is called, the BINDER_WORK_RETURN_ERROR is sitting on the thread's todo list since the read_size was 0 and the client is not waiting for a response. The 2nd transaction is sent and the BINDER_WORK_RETURN_ERROR has not been consumed, so the thread's reply_error.cmd is still set (normally cleared when the BINDER_WORK_RETURN_ERROR is handled). Therefore when the servicemanager attempts to reply to the 2nd failed transaction, the error is already set and it triggers this warning. This is a user error since it is not waiting for the synchronous transaction to complete. If it ever does check, it will see an error. Changed the WARN() to a pr_warn(). Signed-off-by: Todd Kjos Reported-by: syzbot Cc: stable Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -1933,8 +1933,14 @@ static void binder_send_failed_reply(str &target_thread->todo); wake_up_interruptible(&target_thread->wait); } else { - WARN(1, "Unexpected reply error: %u\n", - target_thread->reply_error.cmd); + /* + * Cannot get here for normal operation, but + * we can if multiple synchronous transactions + * are sent without blocking for responses. + * Just ignore the 2nd error in this case. + */ + pr_warn("Unexpected reply error: %u\n", + target_thread->reply_error.cmd); } binder_inner_proc_unlock(target_thread->proc); binder_thread_dec_tmpref(target_thread);