Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Alice Ryhl 9d053f9856 binder: remove "invalid inc weak" check ... commit d90eeb8ecd227c204ab6c34a17b372bd950b7aa2 upstream. There are no scenarios where a weak increment is invalid on binder_node. The only possible case where it could be invalid is if the kernel delivers BR_DECREFS to the process that owns the node, and then increments the weak refcount again, effectively "reviving" a dead node. However, that is not possible: when the BR_DECREFS command is delivered, the kernel removes and frees the binder_node. The fact that you were able to call binder_inc_node_nilocked() implies that the node is not yet destroyed, which implies that BR_DECREFS has not been delivered to userspace, so incrementing the weak refcount is valid. Note that it's currently possible to trigger this condition if the owner calls BINDER_THREAD_EXIT while node->has_weak_ref is true. This causes BC_INCREFS on binder_ref instances to fail when they should not. Cc: stable@vger.kernel.org Fixes: 457b9a6f09 ("Staging: android: add binder driver") Reported-by: Yu-Ting Tseng <yutingtseng@google.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20251015-binder-weak-inc-v1-1-7914b092c371@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-10-29 14:00:00 +01:00
..
binder.c	binder: remove "invalid inc weak" check	2025-10-29 14:00:00 +01:00
binder_alloc.c	binder: fix unused alloc->free_async_space	2024-01-25 14:34:29 -08:00
binder_alloc.h
binder_alloc_selftest.c
binder_internal.h
binder_trace.h
binderfs.c
Kconfig
Makefile