Commit 6c37bebd authored by Alice Ryhl's avatar Alice Ryhl Committed by Greg Kroah-Hartman
Browse files

rust_binder: avoid mem::take on delivered_deaths 



Similar to the previous commit, List::remove is used on
delivered_deaths, so do not use mem::take on it as that may result in
violations of the List::remove safety requirements.

I don't think this particular case can be triggered because it requires
fd close to run in parallel with an ioctl on the same fd. But let's not
tempt fate.

Cc: stable@vger.kernel.org
Fixes: eafedbc7 ("rust_binder: add Rust Binder driver")
Signed-off-by: default avatarAlice Ryhl <aliceryhl@google.com>
Acked-by: default avatarMiguel Ojeda <ojeda@kernel.org>
Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-2-8ed14a0da63d@google.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3e0ae02b

drivers/android/binder/process.rs

+6 −2
Original line number Diff line number Diff line
@@ -1362,8 +1362,12 @@ fn deferred_release(self: Arc<Self>) { 
            work.into_arc().cancel();

        }



        let delivered_deaths = take(&mut self.inner.lock().delivered_deaths);

        drop(delivered_deaths);

        // Clear delivered_deaths list.

        //

        // Scope ensures that MutexGuard is dropped while executing the body.

        while let Some(delivered_death) = { self.inner.lock().delivered_deaths.pop_front() } {

            drop(delivered_death);

        }



        // Free any resources kept alive by allocated buffers.

        let omapping = self.inner.lock().mapping.take();