Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 22967036 authored by Carlos Llamas's avatar Carlos Llamas Committed by Greg Kroah-Hartman
Browse files

binder: fix hang of unregistered readers 



commit 31643d84b8c3d9c846aa0e20bc033e46c68c7e7d upstream.

With the introduction of binder_available_for_proc_work_ilocked() in
commit 1b77e9dc ("ANDROID: binder: remove proc waitqueue") a binder
thread can only "wait_for_proc_work" after its thread->looper has been
marked as BINDER_LOOPER_STATE_{ENTERED|REGISTERED}.

This means an unregistered reader risks waiting indefinitely for work
since it never gets added to the proc->waiting_threads. If there are no
further references to its waitqueue either the task will hang. The same
applies to readers using the (e)poll interface.

I couldn't find the rationale behind this restriction. So this patch
restores the previous behavior of allowing unregistered threads to
"wait_for_proc_work". Note that an error message for this scenario,
which had previously become unreachable, is now re-enabled.

Fixes: 1b77e9dc ("ANDROID: binder: remove proc waitqueue")
Cc: stable@vger.kernel.org
Cc: Martijn Coenen <maco@google.com>
Cc: Arve Hjønnevåg <arve@google.com>
Signed-off-by: default avatarCarlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240711201452.2017543-1-cmllamas@google.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent e9cafb31

drivers/android/binder.c

+1 −3
Original line number Diff line number Diff line
@@ -998,9 +998,7 @@ static bool binder_has_work(struct binder_thread *thread, bool do_proc_work) 
static bool binder_available_for_proc_work_ilocked(struct binder_thread *thread)

{

	return !thread->transaction_stack &&

		binder_worklist_empty_ilocked(&thread->todo) &&

		(thread->looper & (BINDER_LOOPER_STATE_ENTERED |

				   BINDER_LOOPER_STATE_REGISTERED));

		binder_worklist_empty_ilocked(&thread->todo);

}



static void binder_wakeup_poll_threads_ilocked(struct binder_proc *proc,