FROMLIST: binder: make sure accesses to proc/thread are safe
authorTodd Kjos <tkjos@google.com>
Fri, 12 May 2017 21:42:55 +0000 (14:42 -0700)
committerDanny Wood <danwood76@gmail.com>
Tue, 26 Feb 2019 11:36:32 +0000 (11:36 +0000)
commit82f6ad888b410bb1a173229bd713391f4ec87082
treef7b6f5f8f3ca2a6cfaef334bde02edd3e39dd0bc
parent0b62b5568e4df28c2abd6817236477739c809522
FROMLIST: binder: make sure accesses to proc/thread are safe

(from https://patchwork.kernel.org/patch/9817787/)

binder_thread and binder_proc may be accessed by other
threads when processing transaction. Therefore they
must be prevented from being freed while a transaction
is in progress that references them.

This is done by introducing a temporary reference
counter for threads and procs that indicates that the
object is in use and must not be freed. binder_thread_dec_tmpref()
and binder_proc_dec_tmpref() are used to decrement
the temporary reference.

It is safe to free a binder_thread if there
is no reference and it has been released
(indicated by thread->is_dead).

It is safe to free a binder_proc if it has no
remaining threads and no reference.

A spinlock is added to the binder_transaction
to safely access and set references for t->from
and for debug code to safely access t->to_thread
and t->to_proc.

Change-Id: I0a00a0294c3e93aea8b3f141c6f18e77ad244078
Signed-off-by: Todd Kjos <tkjos@google.com>
drivers/android/binder.c