tree 8be8d84f16f71ee3c2390d83ab3c577f99f0194c
parent a96644aaea8eec69d1158dd7fca7ac93cd5bee88
author Eric Biggers <ebiggers@google.com> 1639182511 -0800
committer Karsten Tausche <karsten@fairphone.com> 1648458789 +0200

binder: use wake_up_pollfree()

commit a880b28a71e39013e357fd3adccd1d8a31bc69a8 upstream.

wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up
all exclusive waiters.  Yet, POLLFREE *must* wake up all waiters.  epoll
and aio poll are fortunately not affected by this, but it's very
fragile.  Thus, the new function wake_up_pollfree() has been introduced.

Convert binder to use wake_up_pollfree().

Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: f5cb779ba163 ("ANDROID: binder: remove waitqueue when thread exits.")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20211209010455.42744-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Change-Id: I0f08d9f9a40348d7d2381607fabe3648416ab2a2
Issue: FP3SEC-255
(cherry picked from commit 0487ea896e62b5a90a81ac6e73c35e595d77f499)