ANDROID: binder: don't enqueue death notifications to thread todo.
authorMartijn Coenen <maco@android.com>
Thu, 31 Aug 2017 08:04:28 +0000 (10:04 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 1 Sep 2017 07:22:50 +0000 (09:22 +0200)
This allows userspace to request death notifications without
having to worry about getting an immediate callback on the same
thread; one scenario where this would be problematic is if the
death recipient handler grabs a lock that was already taken
earlier (eg as part of a nested transaction).

Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/android/binder.c

index afe6ac3..b0f0395 100644 (file)
@@ -3499,22 +3499,12 @@ static int binder_thread_write(struct binder_proc *proc,
                                ref->death = death;
                                if (ref->node->proc == NULL) {
                                        ref->death->work.type = BINDER_WORK_DEAD_BINDER;
-                                       if (thread->looper &
-                                           (BINDER_LOOPER_STATE_REGISTERED |
-                                            BINDER_LOOPER_STATE_ENTERED))
-                                               binder_enqueue_work(
-                                                       proc,
-                                                       &ref->death->work,
-                                                       &thread->todo);
-                                       else {
-                                               binder_inner_proc_lock(proc);
-                                               binder_enqueue_work_ilocked(
-                                                       &ref->death->work,
-                                                       &proc->todo);
-                                               binder_wakeup_proc_ilocked(
-                                                       proc);
-                                               binder_inner_proc_unlock(proc);
-                                       }
+
+                                       binder_inner_proc_lock(proc);
+                                       binder_enqueue_work_ilocked(
+                                               &ref->death->work, &proc->todo);
+                                       binder_wakeup_proc_ilocked(proc);
+                                       binder_inner_proc_unlock(proc);
                                }
                        } else {
                                if (ref->death == NULL) {