From nobody Tue Apr 7 12:20:09 2026 Received: from mail-dy1-f202.google.com (mail-dy1-f202.google.com [74.125.82.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C0571361650 for ; Fri, 3 Apr 2026 18:19:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.202 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775240351; cv=none; b=p/gApq1PuiLfrIVYnMe6MNpQr5kC84JURivKgHWjDMyq9B16hktOCMDwjAvoroJW3+feVEEYdGIvBKgu3oil1KFLGLIyx6dJakaX6B3DTL+6I7w9uDVWEdxcywrNrACVfwN+H1XTOElX83/fPbeEcXxCGE6klSjYWKMk8p+YI/4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775240351; c=relaxed/simple; bh=DMGcPcUBwjNRDhEevINgkIw7BW2A4126aabjvfS7NV8=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=Qoc8nj/5dBXRokgfualinpajMd323dFI7X7LQ+f20ex0lAUCd/Vx8sA5r6qsnS00cSRgQydISRh0wjbb7kh3RfHTYAUYuviWrd8zVg887kaP/oxtootWdPZmR3rmrwZ/nI9ic2IBQt3a6wjZ5Oq9Nxav3HkQRSq8H2XGXM6siIY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--mmaurer.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=VVJ6jJT2; arc=none smtp.client-ip=74.125.82.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--mmaurer.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="VVJ6jJT2" Received: by mail-dy1-f202.google.com with SMTP id 5a478bee46e88-2c0f6593ef5so2739900eec.1 for ; Fri, 03 Apr 2026 11:19:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1775240349; x=1775845149; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=OHzTfqMcnozilQQl2jvVwHFhGHS85GHD6bWcBYmuU+Q=; b=VVJ6jJT2clb7HrZ5v/+o9LVLc1gEbfcMR0NTzYvUnvogHaxsIG2mB1aRop4lVmvmW3 NNoAO/wAIVOK2OE7LrCs+N6Xvg/Po/I/Eo9LU/3t42ufl2rjvH9PV3JGUXTKNPcgPxCd rUmaJIjc/FwlrDTLNaDXcDvkjyjy2Me68wKLtwPKE3UZ8WyWTJXTbCK96zBDaTbJyng8 czBmmTuJjknP++zwHN2RzUL7BjiDNjiNlb0tGXZ1aKdC2ObucOwl5byzwZDX1EX5BLb8 0xfIpcx0xI4hmyTzjLXQWcRuDYtKEvghlnRT6lo8pmmomhXK8UEkMzzRb7lMLnSyHfX2 cbbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775240349; x=1775845149; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=OHzTfqMcnozilQQl2jvVwHFhGHS85GHD6bWcBYmuU+Q=; b=i1E3X6TXKDzjySEnKd6VmnsWxePJdI3XtUw3jrtG60Q+gtygKZH+eHnp6SQN+WS2r+ C/82z88wwEWm3mX+SXGjS1jyo7eCSmaFtxmKpelHTwZ+2dsKQz1xRdcQkRqK/ByRC+yg RrZQyIkKdARi0/Wty21Mm+6+3z6TFAMR1pMjrHysJeS5GEsBAVJMnqVEbYqDjUP5ywod pTSgRLuWWltntWxSyFCgOCpZr0zBaN3NrpwQ8nx+J873yhXs7hwHuTa6+JcWbtqiOryB CojAmjB2FYmY+2gTj7q5gbusEtK12PSrj3dIJ56/vwxsQeMNyazS//Flgb6aP55zWa4r 98kQ== X-Forwarded-Encrypted: i=1; AJvYcCVRI++Pku+jyRBxZM9rZ8O5K0vw0b3rkTzX4OT+kveCgizcTG9CUx13tJMIm0myQ5BZnnKa/OcFI1lwLGA=@vger.kernel.org X-Gm-Message-State: AOJu0YxLy2kEPuuDnpg8L0VH1WDT2HIDYHDNyehUcrn0/xAnOkm+qlko QW8gLXXo95HJ8cOqaBuWbUExatDzU8MfXiz6LunWpX/suOgSmzYyAkNcEigTxtyN0F5PEwbjPsW iNhZugpdEag== X-Received: from dlbsw11.prod.google.com ([2002:a05:7022:3a8b:b0:128:d5fb:9499]) (user=mmaurer job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:221c:b0:12b:ebc9:2464 with SMTP id a92af1059eb24-12bfb7458e5mr1690497c88.22.1775240348597; Fri, 03 Apr 2026 11:19:08 -0700 (PDT) Date: Fri, 03 Apr 2026 18:18:58 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAJEE0GkC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDEwNj3Zz85OyM/JwU3aSkZCNjSwtzS5NkAyWg8oKi1LTMCrBR0bG1tQB Y9d27WgAAAA== X-Change-Id: 20260403-lockhold-bbc2398794c0 X-Developer-Key: i=mmaurer@google.com; a=ed25519; pk=2Ezhl7+fEjTOMVFpplDeak2AdQ8cjJieLRVJdNzrW+E= X-Developer-Signature: v=1; a=ed25519-sha256; t=1775240347; l=2084; i=mmaurer@google.com; s=20250429; h=from:subject:message-id; bh=DMGcPcUBwjNRDhEevINgkIw7BW2A4126aabjvfS7NV8=; b=pNsDaw12iMsw0R5VBlKL/q3u1AdTkf6FlbaTXIIv5ZxbIqL4kiBGPgejWrNZDA5v+55k2TRtd K60uCFhWZQaDS2A4RmaecgHJyoKbCGJEd5cok/x/Ys36X4zSNr/4ruH X-Mailer: b4 0.14.2 Message-ID: <20260403-lockhold-v1-1-c332b56cd8ae@google.com> Subject: [PATCH] rust_binder: Avoid holding lock when dropping delivered_death From: Matthew Maurer To: Greg Kroah-Hartman , "=?utf-8?q?Arve_Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl , Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Wedson Almeida Filho , Matt Gilbride , Paul Moore Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, David Stevens , Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable In 6c37bebd8c926, we switched to looping over the list and dropping each individual node, ostensibly without the lock held in the loop body. If the kernel were using Rust Edition 2024, the comment would be accurate, and the lock would not be held across the drop. However, the kernel is currently using 2021, so tail expression lifetime extension results in the lock being held across the drop. Explicitly binding the expression result to a variable makes the lockguard no longer part of a tail expression, causing the lock to be dropped before entering the loop body. This was detected via `CONFIG_PROVE_LOCKING` identifying an invalid wait context at the drop site. Reported-by: David Stevens Signed-off-by: Matthew Maurer Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reviewed-by: Alice Ryhl --- drivers/android/binder/process.rs | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index f06498129aa9765ecbe7a34af36074f15b7490f1..9812c52dc16ee52044dbaf86e30= a0a3861effefb 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1402,7 +1402,12 @@ fn deferred_release(self: Arc) { // Clear delivered_deaths list. // // Scope ensures that MutexGuard is dropped while executing the bo= dy. - while let Some(delivered_death) =3D { self.inner.lock().delivered_= deaths.pop_front() } { + while let Some(delivered_death) =3D { + // Explicitly bind to avoid tail expression lifetime extension= of the lockguard + // Can be removed when the kernel moves to edition 2024 + let maybe_death =3D self.inner.lock().delivered_deaths.pop_fro= nt(); + maybe_death + } { drop(delivered_death); } =20 --- base-commit: d8a9a4b11a137909e306e50346148fc5c3b63f9d change-id: 20260403-lockhold-bbc2398794c0 Best regards, --=20 Matthew Maurer