5.10-stable patches

added patches:
	binder-don-t-detect-sender-target-during-buffer-cleanup.patch

diff --git a/queue-5.10/binder-don-t-detect-sender-target-during-buffer-cleanup.patch b/queue-5.10/binder-don-t-detect-sender-target-during-buffer-cleanup.patch
new file mode 100644 (file)
index 0000000..a51f9ca
--- /dev/null
+++ b/queue-5.10/binder-don-t-detect-sender-target-during-buffer-cleanup.patch
@@ -0,0 +1,97 @@
+From 32e9f56a96d8d0f23cb2aeb2a3cd18d40393e787 Mon Sep 17 00:00:00 2001
+From: Todd Kjos <tkjos@google.com>
+Date: Fri, 15 Oct 2021 16:38:11 -0700
+Subject: binder: don't detect sender/target during buffer cleanup
+
+From: Todd Kjos <tkjos@google.com>
+
+commit 32e9f56a96d8d0f23cb2aeb2a3cd18d40393e787 upstream.
+
+When freeing txn buffers, binder_transaction_buffer_release()
+attempts to detect whether the current context is the target by
+comparing current->group_leader to proc->tsk. This is an unreliable
+test. Instead explicitly pass an 'is_failure' boolean.
+
+Detecting the sender was being used as a way to tell if the
+transaction failed to be sent.  When cleaning up after
+failing to send a transaction, there is no need to close
+the fds associated with a BINDER_TYPE_FDA object. Now
+'is_failure' can be used to accurately detect this case.
+
+Fixes: 44d8047f1d87 ("binder: use standard functions to allocate fds")
+Cc: stable <stable@vger.kernel.org>
+Acked-by: Christian Brauner <christian.brauner@ubuntu.com>
+Signed-off-by: Todd Kjos <tkjos@google.com>
+Link: https://lore.kernel.org/r/20211015233811.3532235-1-tkjos@google.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/android/binder.c |   14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2254,7 +2254,7 @@ static void binder_transaction_buffer_re
+               binder_dec_node(buffer->target_node, 1, 0);
+ 
+       off_start_offset = ALIGN(buffer->data_size, sizeof(void *));
+-      off_end_offset = is_failure ? failed_at :
++      off_end_offset = is_failure && failed_at ? failed_at :
+                               off_start_offset + buffer->offsets_size;
+       for (buffer_offset = off_start_offset; buffer_offset < off_end_offset;
+            buffer_offset += sizeof(binder_size_t)) {
+@@ -2340,9 +2340,8 @@ static void binder_transaction_buffer_re
+                       binder_size_t fd_buf_size;
+                       binder_size_t num_valid;
+ 
+-                      if (proc->tsk != current->group_leader) {
++                      if (is_failure) {
+                               /*
+-                               * Nothing to do if running in sender context
+                                * The fd fixups have not been applied so no
+                                * fds need to be closed.
+                                */
+@@ -3544,6 +3543,7 @@ err_invalid_target_handle:
+  * binder_free_buf() - free the specified buffer
+  * @proc:     binder proc that owns buffer
+  * @buffer:   buffer to be freed
++ * @is_failure:       failed to send transaction
+  *
+  * If buffer for an async transaction, enqueue the next async
+  * transaction from the node.
+@@ -3553,7 +3553,7 @@ err_invalid_target_handle:
+ static void
+ binder_free_buf(struct binder_proc *proc,
+               struct binder_thread *thread,
+-              struct binder_buffer *buffer)
++              struct binder_buffer *buffer, bool is_failure)
+ {
+       binder_inner_proc_lock(proc);
+       if (buffer->transaction) {
+@@ -3581,7 +3581,7 @@ binder_free_buf(struct binder_proc *proc
+               binder_node_inner_unlock(buf_node);
+       }
+       trace_binder_transaction_buffer_release(buffer);
+-      binder_transaction_buffer_release(proc, thread, buffer, 0, false);
++      binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure);
+       binder_alloc_free_buf(&proc->alloc, buffer);
+ }
+ 
+@@ -3782,7 +3782,7 @@ static int binder_thread_write(struct bi
+                                    proc->pid, thread->pid, (u64)data_ptr,
+                                    buffer->debug_id,
+                                    buffer->transaction ? "active" : "finished");
+-                      binder_free_buf(proc, thread, buffer);
++                      binder_free_buf(proc, thread, buffer, false);
+                       break;
+               }
+ 
+@@ -4470,7 +4470,7 @@ retry:
+                       buffer->transaction = NULL;
+                       binder_cleanup_transaction(t, "fd fixups failed",
+                                                  BR_FAILED_REPLY);
+-                      binder_free_buf(proc, thread, buffer);
++                      binder_free_buf(proc, thread, buffer, true);
+                       binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
+                                    "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
+                                    proc->pid, thread->pid,

diff --git a/queue-5.10/series b/queue-5.10/series
index 947cb21a82c9ccfa16c84f76a4834544ff172772..7af153232eae9dbbedb7fe4aa3acf3365b2fd6e9 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -6,3 +6,4 @@ mm-filemap-check-if-thp-has-hwpoisoned-subpage-for-pmd-page-fault.patch
 usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch
 usb-musb-balance-list-entry-in-musb_gadget_queue.patch
 usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch
+binder-don-t-detect-sender-target-during-buffer-cleanup.patch