Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220415120015.52684-1-ales.astone@gmail.com> <20220415120015.52684-2-ales.astone@gmail.com>
In-Reply-To: <20220415120015.52684-2-ales.astone@gmail.com>
From:   Todd Kjos <tkjos@google.com>
Date:   Tue, 19 Apr 2022 11:48:23 -0700
Message-ID: <CAHRSSEwZZMRkytqAMQOL7Ms6dCNZ7VaEf+ykLz82uAVW58Lxdw@mail.gmail.com>
Subject: Re: [PATCH v2 1/2] binder: Address corner cases in deferred copy and fixup
To:     Alessandro Astone <ales.astone@gmail.com>
Cc:     tkjos@android.com, gregkh@linuxfoundation.org, brauner@kernel.org,
        arve@android.com, linux-kernel@vger.kernel.org, maco@android.com,
        Joel Fernandes <joel@joelfernandes.org>,
        Hridya Valsaraju <hridya@google.com>,
        Suren Baghdasaryan <surenb@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, Apr 15, 2022 at 5:00 AM Alessandro Astone <ales.astone@gmail.com> wrote:
>
> When handling BINDER_TYPE_FDA object we are pushing a parent fixup
> with a certain skip_size but no scatter-gather copy object, since
> the copy is handled standalone.
> If BINDER_TYPE_FDA is the last children the scatter-gather copy
> loop will never stop to skip it, thus we are left with an item in
> the parent fixup list. This will trigger the BUG_ON().
>
> This is reproducible in android when playing a video.
> We receive a transaction that looks like this:
>     obj[0] BINDER_TYPE_PTR, parent
>     obj[1] BINDER_TYPE_PTR, child
>     obj[2] BINDER_TYPE_PTR, child
>     obj[3] BINDER_TYPE_FDA, child
>
> Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
> Signed-off-by: Alessandro Astone <ales.astone@gmail.com>

Acked-by: Todd Kjos <tkjos@google.com>


> ---
>  drivers/android/binder.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 8351c5638880..31176edb1069 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2295,6 +2295,7 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
>  {
>         int ret = 0;
>         struct binder_sg_copy *sgc, *tmpsgc;
> +       struct binder_ptr_fixup *tmppf;
>         struct binder_ptr_fixup *pf =
>                 list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
>                                          node);
> @@ -2349,7 +2350,11 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
>                 list_del(&sgc->node);
>                 kfree(sgc);
>         }
> -       BUG_ON(!list_empty(pf_head));
> +       list_for_each_entry_safe(pf, tmppf, pf_head, node) {
> +               BUG_ON(pf->skip_size == 0);
> +               list_del(&pf->node);
> +               kfree(pf);
> +       }
>         BUG_ON(!list_empty(sgc_head));
>
>         return ret > 0 ? -EINVAL : ret;
> --
> 2.35.1
>