Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7521616f authored by Sherry Yang's avatar Sherry Yang Committed by Bernhard Thoben
Browse files

FP-BP: android: binder: Don't get mm from task 



Use binder_alloc struct's mm_struct rather than getting
a reference to the mm struct through get_task_mm to
avoid a potential deadlock between lru lock, task lock and
dentry lock, since a thread can be holding the task lock
and the dentry lock while trying to acquire the lru lock.

Acked-by: default avatarArve Hjønnevåg <arve@android.com>
Signed-off-by: default avatarSherry Yang <sherryy@android.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit a0c2baaf81bd53dc76fccdddc721ba7dbb62be21)
parent 8ee93a42

drivers/android/binder_alloc.c

+5 −8
Original line number Original line Diff line number Diff line
@@ -217,17 +217,13 @@ static int binder_update_page_range(struct binder_alloc *alloc, int allocate, 
		}

		}

	}

	}





	if (need_mm)

	if (!vma && need_mm && mmget_not_zero(alloc->vma_vm_mm))

		mm = get_task_mm(alloc->tsk);

		mm = alloc->vma_vm_mm;

>>>>>>> a0c2baaf81bd5 (android: binder: Don't get mm from task)





	if (mm) {

	if (mm) {

		down_read(&mm->mmap_sem);

		down_read(&mm->mmap_sem);

		vma = alloc->vma;

		vma = alloc->vma;

		if (vma && mm != alloc->vma_vm_mm) {

			pr_err("%d: vma mm and task mm mismatch\n",

				alloc->pid);

			vma = NULL;

		}

	}

	}





	if (!vma && need_mm) {

	if (!vma && need_mm) {
@@ -871,6 +867,8 @@ void binder_alloc_deferred_release(struct binder_alloc *alloc) 
		vfree(alloc->buffer);

		vfree(alloc->buffer);

	}

	}

	mutex_unlock(&alloc->mutex);

	mutex_unlock(&alloc->mutex);

	if (alloc->vma_vm_mm)

		mmdrop(alloc->vma_vm_mm);





	binder_alloc_debug(BINDER_DEBUG_OPEN_CLOSE,

	binder_alloc_debug(BINDER_DEBUG_OPEN_CLOSE,

		     "%s: %d buffers %d, pages %d\n",

		     "%s: %d buffers %d, pages %d\n",
@@ -1078,7 +1076,6 @@ static struct shrinker binder_shrinker = { 
 */

 */

void binder_alloc_init(struct binder_alloc *alloc)

void binder_alloc_init(struct binder_alloc *alloc)

{

{

	alloc->tsk = current->group_leader;

	alloc->pid = current->group_leader->pid;

	alloc->pid = current->group_leader->pid;

	mutex_init(&alloc->mutex);

	mutex_init(&alloc->mutex);

	INIT_LIST_HEAD(&alloc->buffers);

	INIT_LIST_HEAD(&alloc->buffers);

drivers/android/binder_alloc.h

+0 −1
Original line number Original line Diff line number Diff line
@@ -102,7 +102,6 @@ struct binder_lru_page { 
 */

 */

struct binder_alloc {

struct binder_alloc {

	struct mutex mutex;

	struct mutex mutex;

	struct task_struct *tsk;

	struct vm_area_struct *vma;

	struct vm_area_struct *vma;

	struct mm_struct *vma_vm_mm;

	struct mm_struct *vma_vm_mm;

	void *buffer;

	void *buffer;