On 5 September 2017 at 22:51, Todd Kjos <tkjos@xxxxxxxxxxx> wrote:
> From: Xu YiPing <xuyiping@xxxxxxxxxxxxx>
>
> commit 7a4408c6bd3e ("binder: make sure accesses to proc/thread are
> safe") made a change to enqueue tcomplete to thread->todo before
> enqueuing the transaction. However, in err_dead_proc_or_thread case,
> the tcomplete is directly freed, without dequeued. It may cause the
> thread->todo list to be corrupted.
>
> So, dequeue it before freeing.
I see Android boot loops with this patch on hikey tracking
linux/master branch. 1st boot is fine but hikey runs into an
unexpected short boot loops on 2nd and successive boots.
It takes about 3-4 iterations to finally come to sane state and boot
to UI. I don't see this behaviour if I revert this patch.
Regards,
Amit Pundir
>
> Signed-off-by: Xu YiPing <xuyiping@xxxxxxxxxxxxx>
> Signed-off-by: Todd Kjos <tkjos@xxxxxxxxxx>
> ---
> drivers/android/binder.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index d055b3f2a207..96cc28afa383 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -3083,6 +3083,7 @@ static void binder_transaction(struct binder_proc *proc,
> err_dead_proc_or_thread:
> return_error = BR_DEAD_REPLY;
> return_error_line = __LINE__;
> + binder_dequeue_work(proc, tcomplete);
> err_translate_failed:
> err_bad_object_type:
> err_bad_offset:
> --
> 2.14.1.581.gf28d330327-goog
>
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
