Messages in this thread | | | Date | Tue, 7 Nov 2023 09:07:59 +0000 | Subject | Re: [PATCH 03/21] binder: fix race between mmput() and do_exit() | From | Alice Ryhl <> |
| |
Carlos Llamas <cmllamas@google.com> writes: > Task A calls binder_update_page_range() to allocate and insert pages on > a remote address space from Task B. For this, Task A pins the remote mm > via mmget_not_zero() first. This can race with Task B do_exit() and the > final mmput() refcount decrement will come from Task A. > > Task A | Task B > ------------------+------------------ > mmget_not_zero() | > | do_exit() > | exit_mm() > | mmput() > mmput() | > exit_mmap() | > remove_vma() | > fput() | > > In this case, the work of ____fput() from Task B is queued up in Task A > as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup > work gets executed. However, Task A instead sleep, waiting for a reply > from Task B that never comes (it's dead). > > This means the binder_deferred_release() is blocked until an unrelated > binder event forces Task A to go back to userspace. All the associated > death notifications will also be delayed until then. > > In order to fix this use mmput_async() that will schedule the work in > the corresponding mm->async_put_work WQ instead of Task A. > > Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") > Signed-off-by: Carlos Llamas <cmllamas@google.com>
Nice catch!
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
The code really could use a comment, though.
Alice
| |