Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp1147431iob; Wed, 4 May 2022 15:57:12 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyseBP2qkb9Fv+jtBAbV3JzPboqDqx9Znc3ObmTTvNn1Fur0Z2IJMQntl1ifGuLhS1O5+QM X-Received: by 2002:a17:907:3f8e:b0:6f4:4723:4185 with SMTP id hr14-20020a1709073f8e00b006f447234185mr16615641ejc.359.1651705031906; Wed, 04 May 2022 15:57:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651705031; cv=none; d=google.com; s=arc-20160816; b=x0FFWKDsyQMhty0osDOvsrhuTUNEBtwBCNQsl/YiSrIjtINZpquZiou4xzYOfANdqe 1/yp3ealAef70FXiU6jcf9KarXfzrPVHpmGvIQtOW4d7JyzpNQVv7oAY3aTsdRqsGxTu t+Z5mxMSsHT0TNXZl+0NEkd0Q9IJV7CiDErMEfzahIcynhaq+Gt+hjwmfy66axJImcgM gAEUAARZmhS7f30A2gDjBqfTpCMrkEtcM4KW9STyiCH0eJ0hcFA6SJUHFzpHcEuc6Vdw YEgFyuWPT9Wc4L1khY3iXOqBtr4YsgbJjnAfj33aahXOIKqt/CLAM36ZOawyzk7E57Td 6A5w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=F7WecR5Rmk4kZbayQMEPBlhVSA3sG1s1WfzqB8MSr28=; b=uZ03h4b5oMIXgMWMpyQasoOYBi71ZujiXrgQ2KYC389/lwig/xjiF5OLB+mV0ljocK y/6GfhPrxhHihQfiGdNo2GgE2aBnje9ic5IsDQwpa/yCH9FSFSH3DZk57qJdQ8pwSXSF rPKYE0kf4DjfG0lU0uN7XqO0BgsfIxXCAvccBNwwFbr5zd43M8a6utX3PqnaKCGvVigm tOixQyZ737uRRbWNwplyAbxOD5TK4BLtatFsgwSYT1/IGAjXnQkSQBrzIlMtATytC2X2 kTJCfjYQdyHPY7jJolC4bFRm2Oz1iwFJTEug/ivtYSIqixrIK7E3kIsfCob5GE7RDssz W2WA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=KQ7Kogwt; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id m4-20020a17090679c400b006f490429c4fsi202345ejo.534.2022.05.04.15.56.48; Wed, 04 May 2022 15:57:11 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=KQ7Kogwt; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358805AbiEDRjJ (ORCPT + 99 others); Wed, 4 May 2022 13:39:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39182 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356819AbiEDRJp (ORCPT ); Wed, 4 May 2022 13:09:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 61F3021809; Wed, 4 May 2022 09:55:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F2047617DE; Wed, 4 May 2022 16:55:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 461BBC385A4; Wed, 4 May 2022 16:55:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1651683346; bh=jY/z4a730pmHURkZV1MCag3s0fgPGWCDRkatCxnWXwE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KQ7KogwtH18JTee1Mj1E3E4V1Xh3gvGyHDbRUBx0+uTk9UZ1BI8X7l/3xm4s99oUI JMtmWZYew98iJGOcdW4ldfEObg8p3M0h5MOQVj9rwNbwb0qnljqfhmcKeFQi3ztGRz MZI9PdpuMpEcFQ7u5qMyNMhZqRchgmfMNNJsLkA0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Todd Kjos , stable , Alessandro Astone Subject: [PATCH 5.17 033/225] binder: Address corner cases in deferred copy and fixup Date: Wed, 4 May 2022 18:44:31 +0200 Message-Id: <20220504153113.195603183@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220504153110.096069935@linuxfoundation.org> References: <20220504153110.096069935@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alessandro Astone commit 2d1746e3fda0c3612143d7c06f8e1d1830c13e23 upstream. When handling BINDER_TYPE_FDA object we are pushing a parent fixup with a certain skip_size but no scatter-gather copy object, since the copy is handled standalone. If BINDER_TYPE_FDA is the last children the scatter-gather copy loop will never stop to skip it, thus we are left with an item in the parent fixup list. This will trigger the BUG_ON(). This is reproducible in android when playing a video. We receive a transaction that looks like this: obj[0] BINDER_TYPE_PTR, parent obj[1] BINDER_TYPE_PTR, child obj[2] BINDER_TYPE_PTR, child obj[3] BINDER_TYPE_FDA, child Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data") Acked-by: Todd Kjos Cc: stable Signed-off-by: Alessandro Astone Link: https://lore.kernel.org/r/20220415120015.52684-2-ales.astone@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2295,6 +2295,7 @@ static int binder_do_deferred_txn_copies { int ret = 0; struct binder_sg_copy *sgc, *tmpsgc; + struct binder_ptr_fixup *tmppf; struct binder_ptr_fixup *pf = list_first_entry_or_null(pf_head, struct binder_ptr_fixup, node); @@ -2349,7 +2350,11 @@ static int binder_do_deferred_txn_copies list_del(&sgc->node); kfree(sgc); } - BUG_ON(!list_empty(pf_head)); + list_for_each_entry_safe(pf, tmppf, pf_head, node) { + BUG_ON(pf->skip_size == 0); + list_del(&pf->node); + kfree(pf); + } BUG_ON(!list_empty(sgc_head)); return ret > 0 ? -EINVAL : ret;