From: Carlos Llamas <cmllamas@google.com>
To: Alice Ryhl <aliceryhl@google.com>
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Miguel Ojeda" <ojeda@kernel.org>,
"Boqun Feng" <boqun@kernel.org>, "Gary Guo" <gary@garyguo.net>,
"Björn Roy Baron" <bjorn3_gh@protonmail.com>,
"Benno Lossin" <lossin@kernel.org>,
"Andreas Hindborg" <a.hindborg@kernel.org>,
"Trevor Gross" <tmgross@umich.edu>,
"Danilo Krummrich" <dakr@kernel.org>,
"Daniel Almeida" <daniel.almeida@collabora.com>,
"Tamir Duberstein" <tamird@kernel.org>,
"Alexandre Courbot" <acourbot@nvidia.com>,
"Onur Özkan" <work@onurozkan.dev>,
rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH] rust_binder: push BR_TRANSACTION_COMPLETE before BR_FAILED_REPLY
Date: Mon, 9 Nov 2026 22:38:09 +0000 [thread overview]
Message-ID: <avJLUdbdxhhUDL7K@google.com> (raw)
In-Reply-To: <20261028-binder-reply-fail-v1-1-8b71d4daaf1d@google.com>
On Wed, Oct 28, 2026 at 09:46:45AM +0000, Alice Ryhl wrote:
> When building a reply fails in Thread::reply_inner(), BR_FAILED_REPLY is
> delivered to the caller before BR_TRANSACTION_COMPLETE is pushed to the
> replying thread's work list.
>
> In a nested transaction, the caller can wake up upon receiving
> BR_FAILED_REPLY and send an outer reply to the replying thread before
> BR_TRANSACTION_COMPLETE is queued. This causes the outer BR_REPLY to
> arrive ahead of BR_TRANSACTION_COMPLETE, which is not legal. This leads
> to userspace tripping on an assertion.
>
> Thus, push BR_TRANSACTION_COMPLETE in Thread::reply_inner() before
> delivering BR_FAILED_REPLY to the caller.
>
> As a nice side effect, this lets us remove the now-unused
> BR_TRANSACTION_COMPLETE error path in Thread::transaction().
>
> Cc: stable@vger.kernel.org
> Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
Sorry for the late reply, LGTM!
Acked-by: Carlos Llamas <cmllamas@google.com>
prev parent reply other threads:[~2026-11-09 22:38 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-28 9:46 [PATCH] rust_binder: push BR_TRANSACTION_COMPLETE before BR_FAILED_REPLY Alice Ryhl
2026-11-09 22:38 ` Carlos Llamas [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avJLUdbdxhhUDL7K@google.com \
--to=cmllamas@google.com \
--cc=a.hindborg@kernel.org \
--cc=acourbot@nvidia.com \
--cc=aliceryhl@google.com \
--cc=bjorn3_gh@protonmail.com \
--cc=boqun@kernel.org \
--cc=dakr@kernel.org \
--cc=daniel.almeida@collabora.com \
--cc=gary@garyguo.net \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lossin@kernel.org \
--cc=ojeda@kernel.org \
--cc=rust-for-linux@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tamird@kernel.org \
--cc=tmgross@umich.edu \
--cc=work@onurozkan.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.