FROMLIST: binder: make sure target_node has strong ref

(from https://patchwork.kernel.org/patch/9817787/)

When initiating a transaction, the target_node must
have a strong ref on it. Then we take a second
strong ref to make sure the node survives until the
transaction is complete.

Change-Id: If7429cb43eda520ab89d45df6c19327cee97c60c
Signed-off-by: Todd Kjos <tkjos@google.com>

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 3ecabdd28211c98c085a2b14bea6ec95f9f68276..3af8a3b6b6ded18181dfb778c30a8c8c85d79d63 100644 (file)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1470,8 +1470,19 @@ static void binder_transaction(struct binder_proc *proc,
                if (tr->target.handle) {
                        struct binder_ref *ref;
 
+                       /*
+                        * There must already be a strong ref
+                        * on this node. If so, do a strong
+                        * increment on the node to ensure it
+                        * stays alive until the transaction is
+                        * done.
+                        */
                        ref = binder_get_ref(proc, tr->target.handle, true);
-                       if (ref == NULL) {
+                       if (ref) {
+                               binder_inc_node(ref->node, 1, 0, NULL);
+                               target_node = ref->node;
+                       }
+                       if (target_node == NULL) {
                                binder_user_error("%d:%d got transaction to invalid handle\n",
                                        proc->pid, thread->pid);
                                return_error = BR_FAILED_REPLY;
@@ -1479,7 +1490,6 @@ static void binder_transaction(struct binder_proc *proc,
                                return_error_line = __LINE__;
                                goto err_invalid_target_handle;
                        }
-                       target_node = ref->node;
                } else {
                        mutex_lock(&context->context_mgr_node_lock);
                        target_node = context->binder_context_mgr_node;
@@ -1489,6 +1499,7 @@ static void binder_transaction(struct binder_proc *proc,
                                return_error_line = __LINE__;
                                goto err_no_context_mgr_node;
                        }
+                       binder_inc_node(target_node, 1, 0, NULL);
                        mutex_unlock(&context->context_mgr_node_lock);
                }
                e->to_node = target_node->debug_id;
@@ -1608,9 +1619,6 @@ static void binder_transaction(struct binder_proc *proc,
        t->buffer->transaction = t;
        t->buffer->target_node = target_node;
        trace_binder_transaction_alloc_buf(t->buffer);
-       if (target_node)
-               binder_inc_node(target_node, 1, 0, NULL);
-
        off_start = (binder_size_t *)(t->buffer->data +
                                      ALIGN(tr->data_size, sizeof(void *)));
        offp = off_start;
@@ -1847,6 +1855,7 @@ err_bad_parent:
 err_copy_data_failed:
        trace_binder_transaction_failed_buffer_release(t->buffer);
        binder_transaction_buffer_release(target_proc, t->buffer, offp);
+       target_node = NULL;
        t->buffer->transaction = NULL;
        binder_alloc_free_buf(&target_proc->alloc, t->buffer);
 err_binder_alloc_buf_failed:
@@ -1861,6 +1870,9 @@ err_empty_call_stack:
 err_dead_binder:
 err_invalid_target_handle:
 err_no_context_mgr_node:
+       if (target_node)
+               binder_dec_node(target_node, 1, 0);
+
        binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
                     "%d:%d transaction failed %d/%d, size %lld-%lld line %d\n",
                     proc->pid, thread->pid, return_error, return_error_param,