Re: [PATCH v2 1/2] binder: Address corner cases in deferred copy and fixup

[Todd Kjos]

On Fri, Apr 15, 2022 at 5:00 AM Alessandro Astone <ales.astone@xxxxxxxxx> wrote:
>
> When handling BINDER_TYPE_FDA object we are pushing a parent fixup
> with a certain skip_size but no scatter-gather copy object, since
> the copy is handled standalone.
> If BINDER_TYPE_FDA is the last children the scatter-gather copy
> loop will never stop to skip it, thus we are left with an item in
> the parent fixup list. This will trigger the BUG_ON().
>
> This is reproducible in android when playing a video.
> We receive a transaction that looks like this:
>     obj[0] BINDER_TYPE_PTR, parent
>     obj[1] BINDER_TYPE_PTR, child
>     obj[2] BINDER_TYPE_PTR, child
>     obj[3] BINDER_TYPE_FDA, child
>
> Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
> Signed-off-by: Alessandro Astone <ales.astone@xxxxxxxxx>

Acked-by: Todd Kjos <tkjos@xxxxxxxxxx>


> ---
>  drivers/android/binder.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 8351c5638880..31176edb1069 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2295,6 +2295,7 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
>  {
>         int ret = 0;
>         struct binder_sg_copy *sgc, *tmpsgc;
> +       struct binder_ptr_fixup *tmppf;
>         struct binder_ptr_fixup *pf =
>                 list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
>                                          node);
> @@ -2349,7 +2350,11 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
>                 list_del(&sgc->node);
>                 kfree(sgc);
>         }
> -       BUG_ON(!list_empty(pf_head));
> +       list_for_each_entry_safe(pf, tmppf, pf_head, node) {
> +               BUG_ON(pf->skip_size == 0);
> +               list_del(&pf->node);
> +               kfree(pf);
> +       }
>         BUG_ON(!list_empty(sgc_head));
>
>         return ret > 0 ? -EINVAL : ret;
> --
> 2.35.1
>