From: Carlos Llamas <cmllamas@google.com>
To: Todd Kjos <tkjos@google.com>
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Arve Hjønnevåg" <arve@android.com>,
"Todd Kjos" <tkjos@android.com>,
"Martijn Coenen" <maco@android.com>,
"Joel Fernandes" <joel@joelfernandes.org>,
"Christian Brauner" <brauner@kernel.org>,
"Suren Baghdasaryan" <surenb@google.com>,
"Alice Ryhl" <aliceryhl@google.com>,
linux-kernel@vger.kernel.org, kernel-team@android.com,
syzkaller-bugs@googlegroups.com, stable@vger.kernel.org,
syzbot+3dae065ca76952a67257@syzkaller.appspotmail.com
Subject: Re: [PATCH] binder: fix descriptor lookup for context manager
Date: Tue, 16 Jul 2024 19:00:37 +0000 [thread overview]
Message-ID: <ZpbDVXiiVVxyx84X@google.com> (raw)
In-Reply-To: <ZpbAlnAeCv-eiNzF@google.com>
On Tue, Jul 16, 2024 at 06:48:54PM +0000, Carlos Llamas wrote:
> On Tue, Jul 16, 2024 at 10:40:20AM -0700, Todd Kjos wrote:
> > If context manager doesn't need to be bit 0 anymore, then why do we
> > bother to prefer bit 0? Does it matter?
> >
> > It would simplify the code below if the offset is always 0 since you
> > wouldn't need an offset at all.
>
> Yes, it would make things simplier if references to the context manager
> could get any descriptor id. However, there seems to be an expectation
> from libbinder that this descriptor would be zero. At least according to
> some folks more familiar with userspace binder than myself.
>
> I think we can revisit this expectation though and also look closer at
> the scenario of a context manager "swap". The procs can still reach the
> new context manager using descriptor 0. However, this may cause some
> issues with operations with refs such as BC_INCREFS/BC_DECREFS.
>
> AFAICT, the context manager doesn't even need a reference. But while we
> dig furhter into this I think the best option is to keep the behavior
> the same for now: reserve descriptor zero for the context manager node
> unless it's already taken. Changing this is non-trivial IMO.
>
> --
> Carlos Llamas
Also, we need to consider that references to regular nodes (not context
manager) cannot get descriptor zero assigned to them for obvious
reasons. So descriptor zero is always reserved for the context manager,
but there might be certain scenarios in which references to the context
manager get a non-zero descriptor.
next prev parent reply other threads:[~2024-07-16 19:00 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-13 10:25 [syzbot] [kernel?] kernel BUG in binder_inc_ref_for_node syzbot
2024-07-13 13:21 ` Hillf Danton
2024-07-13 13:56 ` syzbot
2024-07-15 20:23 ` Carlos Llamas
2024-07-15 23:52 ` syzbot
2024-07-16 4:28 ` [PATCH] binder: fix descriptor lookup for context manager Carlos Llamas
2024-07-16 17:40 ` Todd Kjos
2024-07-16 18:48 ` Carlos Llamas
2024-07-16 19:00 ` Carlos Llamas [this message]
2024-07-22 10:57 ` Alice Ryhl
2024-07-22 15:39 ` Carlos Llamas
2024-07-22 11:30 ` Alice Ryhl
2024-07-22 15:05 ` [PATCH v2] " Carlos Llamas
2024-07-22 15:50 ` Carlos Llamas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZpbDVXiiVVxyx84X@google.com \
--to=cmllamas@google.com \
--cc=aliceryhl@google.com \
--cc=arve@android.com \
--cc=brauner@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=joel@joelfernandes.org \
--cc=kernel-team@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=stable@vger.kernel.org \
--cc=surenb@google.com \
--cc=syzbot+3dae065ca76952a67257@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tkjos@android.com \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox