tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

binder: remove "invalid inc weak" check

There are no scenarios where a weak increment is invalid on binder_node.
The only possible case where it could be invalid is if the kernel
delivers BR_DECREFS to the process that owns the node, and then
increments the weak refcount again, effectively "reviving" a dead node.

However, that is not possible: when the BR_DECREFS command is delivered,
the kernel removes and frees the binder_node. The fact that you were
able to call binder_inc_node_nilocked() implies that the node is not yet
destroyed, which implies that BR_DECREFS has not been delivered to
userspace, so incrementing the weak refcount is valid.

Note that it's currently possible to trigger this condition if the owner
calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes
BC_INCREFS on binder_ref instances to fail when they should not.

Cc: stable@vger.kernel.org
Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Reported-by: Yu-Ting Tseng <yutingtseng@google.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Alice Ryhl and committed by
Greg Kroah-Hartman d90eeb8e 2463ae28

+1 -10
+1 -10
drivers/android/binder.c
··· 851 851 } else { 852 852 if (!internal) 853 853 node->local_weak_refs++; 854 - if (!node->has_weak_ref && list_empty(&node->work.entry)) { 855 - if (target_list == NULL) { 856 - pr_err("invalid inc weak node for %d\n", 857 - node->debug_id); 858 - return -EINVAL; 859 - } 860 - /* 861 - * See comment above 862 - */ 854 + if (!node->has_weak_ref && target_list && list_empty(&node->work.entry)) 863 855 binder_enqueue_work_ilocked(&node->work, target_list); 864 - } 865 856 } 866 857 return 0; 867 858 }