Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-10-03 Thread Amit Pundir
Hi, On 12 September 2017 at 13:50, Martijn Coenen wrote: > Hi Amit, > > Can you try with the patch I sent to LKML recently, "[PATCH v2 10/13] > ANDROID: binder: call poll_wait() unconditionally."? This fixes a > problem in binder's poll() implementation that only causes issues > under certain rac

Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-12 Thread Martijn Coenen
Hi Amit, Can you try with the patch I sent to LKML recently, "[PATCH v2 10/13] ANDROID: binder: call poll_wait() unconditionally."? This fixes a problem in binder's poll() implementation that only causes issues under certain racy conditions. I'm not sure why it would only trigger now, as this prob

Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Todd Kjos
Amit, I tested with https://android-git.linaro.org/kernel/linaro-android.git/log/?h=test/hikey-llct. I added a pr_info() above the patch's single line change and in binder_init (so I could easily prove that I was running the correct kernel). First I did 10 reboots with the patch. I saw one failu

Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Greg Kroah-Hartman
On Mon, Sep 11, 2017 at 10:25:14PM +0530, Amit Pundir wrote: > Hi Todd, > > On 11 September 2017 at 21:10, Todd Kjos wrote: > > (resend in plain-text mode -- sorry about that) > > > > Amit, > > > > Are you sure this patch is the culprit? That is pretty surprising > > since this change can only be

Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Amit Pundir
Hi Todd, On 11 September 2017 at 21:10, Todd Kjos wrote: > (resend in plain-text mode -- sorry about that) > > Amit, > > Are you sure this patch is the culprit? That is pretty surprising > since this change can only be hit in a uncommon case (the target node > is valid when we start creating the

Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Todd Kjos
(resend in plain-text mode -- sorry about that) Amit, Are you sure this patch is the culprit? That is pretty surprising since this change can only be hit in a uncommon case (the target node is valid when we start creating the transaction, but dead when we check right before sending it) so it is u

Re: [PATCH] binder: fix memory corruption in binder_transaction binder

2017-09-11 Thread Amit Pundir
On 5 September 2017 at 22:51, Todd Kjos wrote: > From: Xu YiPing > > commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are > safe") made a change to enqueue tcomplete to thread->todo before > enqueuing the transaction. However, in err_dead_proc_or_thread case, > the tcomplete is dir