Merge "binder: NULL pointer reference" (d7515556) · Commits · e / devices / android_kernel_sony_msm8994

drivers/staging/android/binder.c

+19 −9

Original line number	Diff line number	Diff line
		@@ -1209,8 +1209,9 @@ static int binder_inc_ref(struct binder_ref *ref, int strong,
		}


		static int binder_dec_ref(struct binder_ref *ref, int strong)
		static int binder_dec_ref(struct binder_ref **ptr_to_ref, int strong)
		{
		struct binder_ref ref = ptr_to_ref;
		if (strong) {
		if (ref->strong == 0) {
		binder_user_error("%d invalid dec strong, ref %d desc %d s %d w %d\n",
		@@ -1234,8 +1235,10 @@ static int binder_dec_ref(struct binder_ref *ref, int strong)
		}
		ref->weak--;
		}
		if (ref->strong == 0 && ref->weak == 0)
		if (ref->strong == 0 && ref->weak == 0) {
		binder_delete_ref(ref);
		*ptr_to_ref = NULL;
		}
		return 0;
		}

		@@ -1362,7 +1365,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
		binder_debug(BINDER_DEBUG_TRANSACTION,
		" ref %d desc %d (node %d)\n",
		ref->debug_id, ref->desc, ref->node->debug_id);
		binder_dec_ref(ref, fp->type == BINDER_TYPE_HANDLE);
		binder_dec_ref(&ref, fp->type == BINDER_TYPE_HANDLE);
		} break;

		case BINDER_TYPE_FD:
		@@ -2167,18 +2170,25 @@ static int binder_thread_write(struct binder_proc *proc,
		break;
		case BC_RELEASE:
		debug_string = "Release";
		binder_dec_ref(ref, 1);
		binder_dec_ref(&ref, 1);
		break;
		case BC_DECREFS:
		default:
		debug_string = "DecRefs";
		binder_dec_ref(ref, 0);
		binder_dec_ref(&ref, 0);
		break;
		}
		if (ref == NULL) {
		binder_debug(BINDER_DEBUG_USER_REFS,
		"%d:%d %s ref %d desc %d s %d w %d for node %d\n",
		proc->pid, thread->pid, debug_string, ref->debug_id,
		ref->desc, ref->strong, ref->weak, ref->node->debug_id);
		"binder: %d:%d %s ref deleted",
		proc->pid, thread->pid, debug_string);
		} else {
		binder_debug(BINDER_DEBUG_USER_REFS,
		"binder: %d:%d %s ref %d desc %d s %d w %d for node %d\n",
		proc->pid, thread->pid, debug_string,
		ref->debug_id, ref->desc, ref->strong,
		ref->weak, ref->node->debug_id);
		}
		break;
		}
		case BC_INCREFS_DONE: