mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-06-02 11:02:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

rust_binder: avoid mem::take on delivered_deaths

Browse Source 
Similar to the previous commit, List::remove is used on
delivered_deaths, so do not use mem::take on it as that may result in
violations of the List::remove safety requirements.

I don't think this particular case can be triggered because it requires
fd close to run in parallel with an ioctl on the same fd. But let's not
tempt fate.

Cc: stable@vger.kernel.org
Fixes: eafedbc7c0 ("rust_binder: add Rust Binder driver")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-2-8ed14a0da63d@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alice Ryhl
2025-11-11 14:23:33 +00:00
committed by Greg Kroah-Hartman
parent 3e0ae02ba8
commit 6c37bebd8c
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/android/binder/process.rs
View File

@@ -1362,8 +1362,12 @@ fn deferred_release(self: Arc<Self>) {
work.into_arc().cancel();
}
let delivered_deaths = take(&mut self.inner.lock().delivered_deaths);
drop(delivered_deaths);
// Clear delivered_deaths list.
//
// Scope ensures that MutexGuard is dropped while executing the body.
while let Some(delivered_death) = { self.inner.lock().delivered_deaths.pop_front() } {
drop(delivered_death);
}
// Free any resources kept alive by allocated buffers.
let omapping = self.inner.lock().mapping.take();