From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9E1032C11E7 for ; Mon, 27 Apr 2026 16:38:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.178 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777307922; cv=none; b=ODfBmZmIRw2KSCJGuMe3HzxjIyLHfc4RapREuQTOk4jOnyQQR40kyN3ithVQc8twbtF/mWK7jETJPQurXrZKC2Rm/46TK8KOBqKWpjwsgAzAftqCSB90VH6dYRYU+7hRLSmW1xZHm6H+7bHXVYkjVkJwHKKAGn0oWFoxuDwIy2I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777307922; c=relaxed/simple; bh=pEuRsdljZmjc+RoYwAvseZ3l4VB48jTAMQ3fA6OmMhA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=q9VYofUTVBDQqF8Dy5dULFMk8rswR2svXOOmPjHiWlV3MmhmSt6xzy5RS1hsa7U3Lu1AtLe/xTGD8A7b0ZyvnoYbDTBD6dFhDllIctjmd0YNDndR9Py5zaVXX8CO1o+5em/IPx3+A87OaUj/o15ENOSo4vQbdUWDo1TlOGlgoHU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=o7dG4nPH; arc=none smtp.client-ip=209.85.214.178 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="o7dG4nPH" Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2b2e8b95bdbso1955ad.0 for ; Mon, 27 Apr 2026 09:38:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1777307921; x=1777912721; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=mou5LEOoziZ5hu0rzC5dRRjLgyBf9T8pKLIONhy+oAU=; b=o7dG4nPH2NTCgJrsN0eLVVIMBEqDRVdopVdPshr7a6EynziulCzAKtSitXboMkt918 VA7Pv2RvunqcI9yRtQM3Z9Wu0efWj94qJ1kpwN/lNjrtCF29lkKS6bAwPpPk6xlkNh6/ K/z0H2/yNKaj2MrSx6Spl1+1oELx5fcvvQGRp3806xYX6dT2MnRHi52lACMBw53YeeL3 Bozm6ZgiOEUFliqchxvffovBCC3zMKpEYmqhNFRuFmh3M8qtdy9TxG5q18+TA3UfRzEH WxpozvlLLZlZA3kaNPqUR/Am/8nHrFBrPhVVn4iRPgJPUHfQS47DS/EsAHpna3l6/uw3 YA8A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777307921; x=1777912721; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mou5LEOoziZ5hu0rzC5dRRjLgyBf9T8pKLIONhy+oAU=; b=DCCAPa9y1DcxXo4rZWgkEdjvjKT7/UQjMDCV5nbozbAnIDt8zPboZulOGEgT7SP/g4 TBUmmgzYwUC5Je2G1iK2OkwurFzrA71M6bLHhlwnKQQ9GLDNOjx4/qykjneiYHNoTAXV hjtH0sVQpkq98Gp63OsemnhmHEc9Z0OZzsFqTiA7oSj9+zZcJVEGK+X3xdNJod4vfm9C x1AQ+ghUL0Ivd11bbtsogvVpP/Of/QiyXzAtYU0/HY8UFQQVjiaKLHxrpjrobdD3M/nJ vd2em33uOKRFsPejmcda7MZLK6S6IF4EVroqSflMpuzE8r4QaP1ixPL3u/J1A6Pa+3GD pjXA== X-Forwarded-Encrypted: i=1; AFNElJ9IW8V0IQBv62ZGyvEI1AubYE8XYgXrQ5CPB69/k7Vxssd9o9MKcc8rmZwSZuMch+fMbamkU8c=@vger.kernel.org X-Gm-Message-State: AOJu0YyLu6Zz4sadz0vRlG30R7VU/kSNcpde8yNIKcxAEmMZmXhkOtzi 4fxLO1MWvGgfIbJTfNGQ2+R846ZjRIEF0hyKQvlnZyfhYh7ZfL4kD44huo8EFPwGQA== X-Gm-Gg: AeBDievxxavAzTExV/zB3A2gPTdZ+FdInXHpiqOspqT1sLvFJnn1ei4/xCPjUdyPuC3 dr0Ih1qorVpkvok11+N3eS9Z2H97Nkku+oz/Kk9LJsx/MsDq3LGQH+X+oV2ew8eP21AZRMfd7R0 0qOn6JcIxitGBFqDDvC97jn2E2YXYmjoxu9ukrhPh0dgiNWLl4HhA5HgN/+oxolBg4T5w/wVDQ3 J7eOKQRjR9Jq6B6k8YekgBcC9CK1Hir5jm3jI3zCtmOCrdXqlV45G9h0Y39JM9rBczJhxAbpnEL tdkCiGyQfTGuRQSjzB+TDFDaNFI5XMGUgR+ypdAv4G5Y3R10VsRIbZSE4ls0NSEAC/m+afjMOez s7jYZRfB+O3UhFFQUTGRH/s5Baz2+bPrTCd3Gmv65zmGRBday9oe16s0nCCmdCqI30bjVeiZpQH pcqoQ88WSa98I4Aw28Fn4E8NfaFopC1/yvbUHrII0qwQMuwVgifFj6rsz7FUgdECn3QZ8E86Lio qb05b4q5i1Xg9oib06UZc7er/SradZhQp3qbILx80p3t+XOjltyOhBazvscR3OBcGcc4wITeca2 pQ== X-Received: by 2002:a17:903:c05:b0:2b4:6529:7bae with SMTP id d9443c01a7336-2b97a4e7ca7mr109235ad.17.1777307920150; Mon, 27 Apr 2026 09:38:40 -0700 (PDT) Received: from google.com (210.53.125.34.bc.googleusercontent.com. [34.125.53.210]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82f8ebb3f8asm34437785b3a.36.2026.04.27.09.38.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 27 Apr 2026 09:38:38 -0700 (PDT) Date: Mon, 27 Apr 2026 16:38:34 +0000 From: Carlos Llamas To: Alice Ryhl Cc: Greg Kroah-Hartman , Miguel Ojeda , Boqun Feng , Gary Guo , =?iso-8859-1?Q?Bj=F6rn?= Roy Baron , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] rust_binder: avoid calling pending_oneway_finished() on TF_UPDATE_TXN Message-ID: References: <20260414-tf-update-txn-fix-v1-1-d2b83303acc9@google.com> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260414-tf-update-txn-fix-v1-1-d2b83303acc9@google.com> On Tue, Apr 14, 2026 at 12:02:34PM +0000, Alice Ryhl wrote: > When an outdated transaction is removed from `oneway_todo` due to > `TF_UPDATE_TXN`, its `Allocation` is dropped. The current implementation > of `Allocation::drop` calls `pending_oneway_finished()`, assuming the > transaction was executed. This leads to premature execution of the next > queued one-way transaction. > > Fix this by taking the `oneway_node` from the `Allocation` of the > outdated transaction before it is dropped. This prevents > `Allocation::drop` from signaling completion. > > We do not call `take_oneway_node()` from `Transaction::cancel` because > it's actually correct to call `pending_oneway_finished()` on cancel if > the transaction did not come from `oneway_todo`. This ensures that if > `BINDER_THREAD_EXIT` is invoked and cancels a oneway transaction, then > the next transaction is taken from `oneway_todo`. > > This bug does not lead to any issues in the kernel, but may lead to > Binder delivering transactions to userspace earlier than userspace > expected to receive them. > > Cc: stable@vger.kernel.org > Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") > Assisted-by: Antigravity:gemini > Signed-off-by: Alice Ryhl > --- Acked-by: Carlos Llamas