From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D4737083C for ; Mon, 27 Apr 2026 16:38:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.172 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777307922; cv=none; b=fmffNd1UHlbgE1XzLwn8U8xESeDNd92fV3bBdYqD3CDbAK/8Frnve58yvubjYk5TZNPlNebf6EOrqD/BFpU7AmWaC6ZNSN4o5CVXuijR9whyBnCHTUYydH94aJHaFO3lyOip/QQZp4SNbiu61hOaHtdgnOzcqmlMyS6kstD6kwU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777307922; c=relaxed/simple; bh=pEuRsdljZmjc+RoYwAvseZ3l4VB48jTAMQ3fA6OmMhA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=q9VYofUTVBDQqF8Dy5dULFMk8rswR2svXOOmPjHiWlV3MmhmSt6xzy5RS1hsa7U3Lu1AtLe/xTGD8A7b0ZyvnoYbDTBD6dFhDllIctjmd0YNDndR9Py5zaVXX8CO1o+5em/IPx3+A87OaUj/o15ENOSo4vQbdUWDo1TlOGlgoHU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=o7dG4nPH; arc=none smtp.client-ip=209.85.214.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="o7dG4nPH" Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2b243198058so460265ad.1 for ; Mon, 27 Apr 2026 09:38:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1777307921; x=1777912721; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=mou5LEOoziZ5hu0rzC5dRRjLgyBf9T8pKLIONhy+oAU=; b=o7dG4nPH2NTCgJrsN0eLVVIMBEqDRVdopVdPshr7a6EynziulCzAKtSitXboMkt918 VA7Pv2RvunqcI9yRtQM3Z9Wu0efWj94qJ1kpwN/lNjrtCF29lkKS6bAwPpPk6xlkNh6/ K/z0H2/yNKaj2MrSx6Spl1+1oELx5fcvvQGRp3806xYX6dT2MnRHi52lACMBw53YeeL3 Bozm6ZgiOEUFliqchxvffovBCC3zMKpEYmqhNFRuFmh3M8qtdy9TxG5q18+TA3UfRzEH WxpozvlLLZlZA3kaNPqUR/Am/8nHrFBrPhVVn4iRPgJPUHfQS47DS/EsAHpna3l6/uw3 YA8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777307921; x=1777912721; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mou5LEOoziZ5hu0rzC5dRRjLgyBf9T8pKLIONhy+oAU=; b=C4SDeO2nTqbYzAffH3pNY55f2imcrkbXKpwZXw8dShqXbYW4T5urNxHm/dtVjVf3vm Zz5vfs4ocBg5o2I4T22W6a3cPUjRVUhoknLurdXtuTSrggLYMSgDFnfkVoyob9xHbMPN c2qAcXXjoBeMTnPs/ljsanxsV24tM/wg6fC7xFAKLR8fskPncIx3JDppZBDDlc7/A8yw p5C7IXAri/CP1kAD5lDdfDL7f+nI6DCnh9qZXqVK7yU+olhzUPgoubnBSY4TKfQsgWCb 7oAytIZumWUwP3Exf6xjUvt0dHDNyq6f17dt2Zr1OpvAQ32k05L9su/+joA7ejusU/AP MQtw== X-Forwarded-Encrypted: i=1; AFNElJ8I7rlLEJ5/vd1mqTNlKkwe75lJ/cgJ6n13Wec2YQQ/7jf2i4Qp++R5ynZfpt9zY4/4N224IFlH7NuBmFE=@vger.kernel.org X-Gm-Message-State: AOJu0Yx5/5Z0KR4ZDYyhEMD8ltQe1oEb4/7oYwrn3tDgBK5Oxi/d24J6 zPD0OcyyeK/fQCTnhj9iqcUHb1JUFRt8r6DDT05dfFlbv1uTHka+a+bBpif7kR3LeA== X-Gm-Gg: AeBDiesbf01Y226zKKSJ4TvPs4JYM6t3CFaCPeYD3okS0UMAmIX75wEnGhWP5LJWP+z JkLDNgP88eqGfWiBZznJYCpxR74tpOZpFTXUXvU6s6InfR+zp46DB0kHfWKeXiGPezVrwLdlrUh rdcfRFfGJj7Wej/OM/xoAe4z35I/0aKSfVifOe2KlWBQh2RM2qgldp3g0tSGRLcvLcN7AJoHzQ1 sQiRzad0e64U79E2+fXknQYJr48wSxw51za+xGH7vHm14L2x+v6vw7sH+KZeD5SF+w6//KsogTh wGh5i72cAROpqfMikINt9C1ebZJYUsQ95zIFNnIKpcjc+xTmE54n7r2j+RdSujJCDkqJnIWTKw9 v7ivmFOkli7zwvya6gfgOSgeS6Oc5duUZbAc5UqIgNF5XvxsUSBygdYAoRaXUCNKMxD8MQAe9Fi Wr9ErilWM47usS4IEEJ6mp0f6/zV4bQrKhcSYF+Db5Eihy6nc85pqR9JgGssE05L/NiqXU3jx5x 8gCSmDmRmcO/grIx/1BhzFJxQlPO3wKZP50qZjeDDU9ZApKDv+urplM3SxPkx8daXD3YGLd7i7f Mw== X-Received: by 2002:a17:903:c05:b0:2b4:6529:7bae with SMTP id d9443c01a7336-2b97a4e7ca7mr109235ad.17.1777307920150; Mon, 27 Apr 2026 09:38:40 -0700 (PDT) Received: from google.com (210.53.125.34.bc.googleusercontent.com. [34.125.53.210]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f8ebb3f8asm34437785b3a.36.2026.04.27.09.38.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Apr 2026 09:38:38 -0700 (PDT) Date: Mon, 27 Apr 2026 16:38:34 +0000 From: Carlos Llamas To: Alice Ryhl Cc: Greg Kroah-Hartman , Miguel Ojeda , Boqun Feng , Gary Guo , =?iso-8859-1?Q?Bj=F6rn?= Roy Baron , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Message-ID: References: <20260414-tf-update-txn-fix-v1-1-d2b83303acc9@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260414-tf-update-txn-fix-v1-1-d2b83303acc9@google.com> On Tue, Apr 14, 2026 at 12:02:34PM +0000, Alice Ryhl wrote: > When an outdated transaction is removed from `oneway_todo` due to > `TF_UPDATE_TXN`, its `Allocation` is dropped. The current implementation > of `Allocation::drop` calls `pending_oneway_finished()`, assuming the > transaction was executed. This leads to premature execution of the next > queued one-way transaction. > > Fix this by taking the `oneway_node` from the `Allocation` of the > outdated transaction before it is dropped. This prevents > `Allocation::drop` from signaling completion. > > We do not call `take_oneway_node()` from `Transaction::cancel` because > it's actually correct to call `pending_oneway_finished()` on cancel if > the transaction did not come from `oneway_todo`. This ensures that if > `BINDER_THREAD_EXIT` is invoked and cancels a oneway transaction, then > the next transaction is taken from `oneway_todo`. > > This bug does not lead to any issues in the kernel, but may lead to > Binder delivering transactions to userspace earlier than userspace > expected to receive them. > > Cc: stable@vger.kernel.org > Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") > Assisted-by: Antigravity:gemini > Signed-off-by: Alice Ryhl > --- Acked-by: Carlos Llamas