Re: [PATCH] rust_binder: push BR_TRANSACTION_COMPLETE before BR_FAILED_REPLY

[Carlos Llamas]

On Wed, Oct 28, 2026 at 09:46:45AM +0000, Alice Ryhl wrote:
> When building a reply fails in Thread::reply_inner(), BR_FAILED_REPLY is
> delivered to the caller before BR_TRANSACTION_COMPLETE is pushed to the
> replying thread's work list.
> 
> In a nested transaction, the caller can wake up upon receiving
> BR_FAILED_REPLY and send an outer reply to the replying thread before
> BR_TRANSACTION_COMPLETE is queued. This causes the outer BR_REPLY to
> arrive ahead of BR_TRANSACTION_COMPLETE, which is not legal. This leads
> to userspace tripping on an assertion.
> 
> Thus, push BR_TRANSACTION_COMPLETE in Thread::reply_inner() before
> delivering BR_FAILED_REPLY to the caller.
> 
> As a nice side effect, this lets us remove the now-unused
> BR_TRANSACTION_COMPLETE error path in Thread::transaction().
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> Signed-off-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>
> ---

Sorry for the late reply, LGTM!

Acked-by: Carlos Llamas <cmllamas@xxxxxxxxxx>