ANDROID: binder: don't enqueue death notifications to thread todo.

This allows userspace to request death notifications without
having to worry about getting an immediate callback on the same
thread; one scenario where this would be problematic is if the
death recipient handler grabs a lock that was already taken
earlier (eg as part of a nested transaction).

Signed-off-by: Martijn Coenen <maco@android.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Martijn Coenen 2017-08-31 10:04:28 +02:00 committed by Greg Kroah-Hartman
parent 858b271968
commit bb74562a7f
1 changed files with 6 additions and 16 deletions

View File

@ -3499,22 +3499,12 @@ static int binder_thread_write(struct binder_proc *proc,
ref->death = death; ref->death = death;
if (ref->node->proc == NULL) { if (ref->node->proc == NULL) {
ref->death->work.type = BINDER_WORK_DEAD_BINDER; ref->death->work.type = BINDER_WORK_DEAD_BINDER;
if (thread->looper &
(BINDER_LOOPER_STATE_REGISTERED | binder_inner_proc_lock(proc);
BINDER_LOOPER_STATE_ENTERED)) binder_enqueue_work_ilocked(
binder_enqueue_work( &ref->death->work, &proc->todo);
proc, binder_wakeup_proc_ilocked(proc);
&ref->death->work, binder_inner_proc_unlock(proc);
&thread->todo);
else {
binder_inner_proc_lock(proc);
binder_enqueue_work_ilocked(
&ref->death->work,
&proc->todo);
binder_wakeup_proc_ilocked(
proc);
binder_inner_proc_unlock(proc);
}
} }
} else { } else {
if (ref->death == NULL) { if (ref->death == NULL) {