tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

rust_binder: avoid mem::take on delivered_deaths

Similar to the previous commit, List::remove is used on
delivered_deaths, so do not use mem::take on it as that may result in
violations of the List::remove safety requirements.

I don't think this particular case can be triggered because it requires
fd close to run in parallel with an ioctl on the same fd. But let's not
tempt fate.

Cc: stable@vger.kernel.org
Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-2-8ed14a0da63d@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Alice Ryhl and committed by
Greg Kroah-Hartman 6c37bebd 3e0ae02b

+6 -2
+6 -2
drivers/android/binder/process.rs
··· 1362 1362 work.into_arc().cancel(); 1363 1363 } 1364 1364 1365 - let delivered_deaths = take(&mut self.inner.lock().delivered_deaths); 1366 - drop(delivered_deaths); 1365 + // Clear delivered_deaths list. 1366 + // 1367 + // Scope ensures that MutexGuard is dropped while executing the body. 1368 + while let Some(delivered_death) = { self.inner.lock().delivered_deaths.pop_front() } { 1369 + drop(delivered_death); 1370 + } 1367 1371 1368 1372 // Free any resources kept alive by allocated buffers. 1369 1373 let omapping = self.inner.lock().mapping.take();