---

yaml
---
r: 143647
b: refs/heads/master
c: 0cf24a7
h: refs/heads/master
i:
  143645: ff63431
  143643: e4d45ed
  143639: 4b9e3bd
  143631: e041caf
  143615: 643c9b9
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 7af7467efa64affc6505375ceac97d68cfb58e94
+refs/heads/master: 0cf24a7dc9123ddf63c413b6d4b38017b19db713

trunk/drivers/staging/android/binder.c

@@ -1343,6 +1343,17 @@ binder_transaction(struct binder_proc *proc, struct binder_thread *thread,
 		if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
 			struct binder_transaction *tmp;
 			tmp = thread->transaction_stack;
+			if (tmp->to_thread != thread) {
+				binder_user_error("binder: %d:%d got new "
+					"transaction with bad transaction stack"
+					", transaction %d has target %d:%d\n",
+					proc->pid, thread->pid, tmp->debug_id,
+					tmp->to_proc ? tmp->to_proc->pid : 0,
+					tmp->to_thread ?
+					tmp->to_thread->pid : 0);
+				return_error = BR_FAILED_REPLY;
+				goto err_bad_call_stack;
+			}
 			while (tmp) {
 				if (tmp->from && tmp->from->proc == target_proc)
 					target_thread = tmp->from;