From nobody Sat Jun 27 17:08:57 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2DAA93F39DE for ; Mon, 15 Jun 2026 12:36:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527023; cv=none; b=sJUjHalZkoX+RhtLv5mf+HTTatUwqGWhCEj6yruGI5LDHhBlBjgCYyQ/dF1z6riDlxEGxRTKxZUYT6Lh+qImOpZO7suMHR8HhTod7tzBsY3t5rUe9XVk3468QZofJVqbtoIsqQ2mYcwjOhPA91lSfSBKFAcf712bXEzwq2ndnjM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527023; c=relaxed/simple; bh=nU8CMklrZ4pzGEGPtJR5y5DoyOiug+EmYak7mSKNXJQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=T0bm0G+Txscz5jQ2BSjHA2RSv6m0A8UFwbRrfHAuGoB5YRTzTwqp3YZ4aT8PbEP8clFcNyUey4KhX/rIFKOGX0B3xeMSWqg9ZOsUuF/pTx96ZnWTZqjbBrBl0xMaz9W+Amq42mOp67Ni8XJ1e7V/99oAf37gY0BzPf3qrMP30jo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nPNwYLFg; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nPNwYLFg" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-490b61243easo36110375e9.2 for ; Mon, 15 Jun 2026 05:36:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781527017; x=1782131817; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=v2gf6or+nNI5nNsuVDLEiXsD4C1ozOp69hEfNPSp0eM=; b=nPNwYLFgLFL5UaQP7R1y3BZFFW+s9IjQdzzJvYCSchOTzGwa46+ESu3w0A/PtuBSgR H4FEDGGKjmQ3zKYfEZJzbuHLKuhSpe92ssVsvbYypS4wi77v5CVyaPt8Q9JA8ihfqR6v R3AiPigjLwp3hkdfOWE8k54lXJK4aodi+dufzpuHLJnJEdEldbLTCBRA0NKqPuvzGeSk t0STl0UAj5WvTAGsbOHntrXE4BAY8POT4UeKUIevwedFvcQlDoIn7wCAL7E8huiSyv7/ otE4cG6x9UsQ/sMp982ZOmRcUzpNISj6HtQD2MPdXH/Ih6Zd4eMGvjkEvpL5fvdKKDQS PFaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781527017; x=1782131817; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=v2gf6or+nNI5nNsuVDLEiXsD4C1ozOp69hEfNPSp0eM=; b=rrlbD35GnKAxnd9oriWgS9xwFiMGz+mzpsDipkQ8csLH2wwA5Wp8+nhurjkjK0MF/9 f/ShZQlV3eNmHJ8zMcc/1aRzQ2d2jiON/e1BVS2Q6HnCRnqT5C+JjbceFkUUep0bo5Lw pDREvNcza8GIZNQJWNTOgG0PplbHcljonAheX1kPiwsfO2WqbYGIGiJ+SD9JcV2ArTRp bZfp7zkjty5LNzAHAwCW7KM9rPQNKwSc59txIf9vWMPwJyXNIGuVap5mRp5gm8rOgYO2 NVGEz/tNbfVUVEvpPiuwk33Qq7dEbhTB+2hS0KyLdKjRr27syDQkIxD3n0npcxQeeyBG +3gw== X-Forwarded-Encrypted: i=1; AFNElJ/8boKBs0ny9cg5eI3CItOTzsttHz8mLlfCp9ne4Xif6uNofnTMx4f+jAiOuO4DWc+zFeAa6apLMP86LQE=@vger.kernel.org X-Gm-Message-State: AOJu0YzKIBo8J5PP1dyjAJCfJ8sXQhIsK/6MBB4K0EaQjotON0qIy3Dw hzXRuHpmiQqpBYcb55XuSsOurFyAnVmAXPIzHnoC8MAFgsR6RBIJ1KPWTCVkufc67a4fvn2c9dS 5hJI5Tz9rqIkwEyixmA== X-Received: from wmqi7.prod.google.com ([2002:a05:600c:3547:b0:490:5e18:ff1c]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:314a:b0:490:da12:f1fa with SMTP id 5b1f17b1804b1-490ec503f0cmr164316725e9.31.1781527017056; Mon, 15 Jun 2026 05:36:57 -0700 (PDT) Date: Mon, 15 Jun 2026 12:36:41 +0000 In-Reply-To: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=8714; i=aliceryhl@google.com; h=from:subject:message-id; bh=nU8CMklrZ4pzGEGPtJR5y5DoyOiug+EmYak7mSKNXJQ=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqL/HlQ7fchwgODwGJBHs0vFLh68QtTVjmTaV5Q QZVEd6dNrSJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCai/x5QAKCRAEWL7uWMY5 RtsxEACXdxI+z6PPVIUPO4GzFs5e6XDXd5UX/hL/+ztXZSzDrfsz5YsLjRIceMW7lSdwZzCAFXB 4FQx9MEOX1VzIuHzt0sLdgfSu0liiYRE1Ez34ytvTrCAcGQw3jtGEC2mg3YtCorICmBe2rUSPRC ASY7Ya23Bxf0/2NTSo3yajzs6hNODlOr7gNXUlVngt6iBEEHYHk8jlxN3LKIBlZ64/a0F0Tokoy ppnh7UUl1g/DEcQo4y3rJl/oeXhMIZ+DNWr9/1KzEi+0itqsSrih4kJRzdYgQjbtgzdKz0prbUr IgTnUzX4rBqhpNu69wRJlBPLs+/EsAGQghD5rU4tkJhh1HBTpV/8n14AZOBM5hihCQvvBjxHvbp ty6Km7/X2ejisxvXOCQWGtIGjaxUFLCaqqJoFwi0rQS91zvowPPXED5OJjRP4gmrltj4E1fxuAb PfoWeBSAXtWZyPjUCXYUREthtsd8oFfIyFDlp6r4KFTrBsk6nBxX0ZpN+ITxY+okF6ZC3wdrmkW VdHMu6UJh7j6+JMuko6RyCCqB8zNm1w2NGzmbl2UU0EUbXzjOygW98YtnpWPK08ONGBCMaFurG+ BElV4kx8L+1wjBv6zPwunB0GTg/wYC23LSR1HFMt9OAh5DRVy1Fv0rFErueWJ6vLgd1C+3AISs5 Zz5ZUmY5sz7vw9g== X-Mailer: b4 0.14.3 Message-ID: <20260615-binder-noderefs-spin-v3-1-3235f5a3e0a0@google.com> Subject: [PATCH v3 1/6] rust_binder: avoid allocating under node_refs for freeze listeners From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The node_refs mutex needs to be changed to a spinlock, so in preparation for that, update freeze.rs to avoid allocating under the node_refs lock. This is done by adding a retry loop so that if add_freeze_listener() requires reallocating the KVVec<_> of freeze listeners, the caller will allocate a larger vector and retry. Analogously, the remove_freeze_listener() function is updated to return the empty KVVec<_> when it is no longer needed, to avoid calling kvfree() under the node_refs lock. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl --- drivers/android/binder/freeze.rs | 65 +++++++++++++++++++++++++++---------= ---- drivers/android/binder/node.rs | 47 ++++++++++++++--------------- 2 files changed, 67 insertions(+), 45 deletions(-) diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/free= ze.rs index 53b60035639a..2aef4f62cd11 100644 --- a/drivers/android/binder/freeze.rs +++ b/drivers/android/binder/freeze.rs @@ -173,36 +173,58 @@ pub(crate) fn request_freeze_notif( let msg =3D FreezeMessage::new(GFP_KERNEL)?; let alloc =3D RBTreeNodeReservation::new(GFP_KERNEL)?; =20 + let mut afl_vec_alloc =3D KVVec::new(); + let mut info; + let mut freeze_entry; let mut node_refs_guard =3D self.node_refs.lock(); - let node_refs =3D &mut *node_refs_guard; - let Some(info) =3D node_refs.by_handle.get_mut(&handle) else { - pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION invalid ref {}\n", ha= ndle); - return Err(EINVAL); - }; - if info.freeze().is_some() { - pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION already set\n"); - return Err(EINVAL); - } - let node_ref =3D info.node_ref(); - let freeze_entry =3D node_refs.freeze_listeners.entry(cookie); - - if let rbtree::Entry::Occupied(ref dupe) =3D freeze_entry { - if !dupe.get().allow_duplicate(&node_ref.node) { - pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION duplicate cookie\= n"); + loop { + let node_refs =3D &mut *node_refs_guard; + info =3D match node_refs.by_handle.get_mut(&handle) { + Some(info) =3D> info, + None =3D> { + pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION invalid ref {= }\n", handle); + return Err(EINVAL); + } + }; + if info.freeze().is_some() { + pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION already set\n"); return Err(EINVAL); } - } + let node_ref =3D info.node_ref(); + freeze_entry =3D node_refs.freeze_listeners.entry(cookie); + + if let rbtree::Entry::Occupied(ref dupe) =3D freeze_entry { + if !dupe.get().allow_duplicate(&node_ref.node) { + pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION duplicate coo= kie\n"); + return Err(EINVAL); + } + } =20 - // All failure paths must come before this call, and all modificat= ions must come after this - // call. - node_ref.node.add_freeze_listener(self, GFP_KERNEL)?; + // Now we add to the node's freeze listener list, with retry a= nd re-allocate if the + // vector is full. + // + // To ensure that the node is added atomically, this is the fi= rst time we modify any + // state. When this call succeeds, all other modifications mus= t occur without the + // possibility for any failure paths. + match node_ref + .node + .add_freeze_listener(self, &mut afl_vec_alloc)? + { + Ok(()) =3D> break, + Err(resize_target) =3D> { + drop(node_refs_guard); + afl_vec_alloc =3D KVVec::with_capacity(resize_target, = GFP_KERNEL)?; + node_refs_guard =3D self.node_refs.lock(); + } + } + } =20 match freeze_entry { rbtree::Entry::Vacant(entry) =3D> { entry.insert( FreezeListener { cookie, - node: node_ref.node.clone(), + node: info.node_ref().node.clone(), last_is_frozen: None, is_pending: false, is_clearing: false, @@ -273,6 +295,7 @@ pub(crate) fn clear_freeze_notif(self: &Arc, read= er: &mut UserSliceReader) let handle =3D hc.handle; let cookie =3D FreezeCookie(hc.cookie); =20 + let _to_free_fl; let alloc =3D FreezeMessage::new(GFP_KERNEL)?; let mut node_refs_guard =3D self.node_refs.lock(); let node_refs =3D &mut *node_refs_guard; @@ -293,7 +316,7 @@ pub(crate) fn clear_freeze_notif(self: &Arc, read= er: &mut UserSliceReader) return Err(EINVAL); }; listener.is_clearing =3D true; - listener.node.remove_freeze_listener(self); + _to_free_fl =3D listener.node.remove_freeze_listener(self); *info.freeze() =3D None; let mut msg =3D None; if !listener.is_pending { diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs index 69f757ff7461..53fc8ba42e86 100644 --- a/drivers/android/binder/node.rs +++ b/drivers/android/binder/node.rs @@ -657,33 +657,29 @@ fn do_work_locked( pub(crate) fn add_freeze_listener( &self, process: &Arc, - flags: kernel::alloc::Flags, - ) -> Result { - let mut vec_alloc =3D KVVec::>::new(); - loop { - let mut guard =3D self.owner.inner.lock(); - // Do not check for `guard.dead`. The `dead` flag that matters= here is the owner of the - // listener, no the target. - let inner =3D self.inner.access_mut(&mut guard); - let len =3D inner.freeze_list.len(); - if len >=3D inner.freeze_list.capacity() { - if len >=3D vec_alloc.capacity() { - drop(guard); - vec_alloc =3D KVVec::with_capacity((1 + len).next_powe= r_of_two(), flags)?; - continue; - } - mem::swap(&mut inner.freeze_list, &mut vec_alloc); - for elem in vec_alloc.drain_all() { - inner.freeze_list.push_within_capacity(elem)?; - } + // If the vector needs to be resized, it's done via this argument. + vec_alloc: &mut KVVec>, + ) -> Result> { + let mut guard =3D self.owner.inner.lock(); + // Do not check for `guard.dead`. The `dead` flag that matters her= e is the owner of the + // listener, not the target. + let inner =3D self.inner.access_mut(&mut guard); + let len =3D inner.freeze_list.len(); + if len =3D=3D inner.freeze_list.capacity() { + if len >=3D vec_alloc.capacity() { + // Request the caller to reallocate. + return Ok(Err((1 + len).next_power_of_two())); + } + mem::swap(&mut inner.freeze_list, vec_alloc); + for elem in vec_alloc.drain_all() { + inner.freeze_list.push_within_capacity(elem)?; } - inner.freeze_list.push_within_capacity(process.clone())?; - return Ok(()); } + inner.freeze_list.push_within_capacity(process.clone())?; + Ok(Ok(())) } =20 - pub(crate) fn remove_freeze_listener(&self, p: &Arc) { - let _unused_capacity; + pub(crate) fn remove_freeze_listener(&self, p: &Arc) -> KVVec= > { let mut guard =3D self.owner.inner.lock(); let inner =3D self.inner.access_mut(&mut guard); let len =3D inner.freeze_list.len(); @@ -694,9 +690,12 @@ pub(crate) fn remove_freeze_listener(&self, p: &Arc) { p.pid_in_current_ns() ); } + // If the vector is empty it needs to be freed. However, we can't = free it here because that + // might sleep, so return it to the caller. if inner.freeze_list.is_empty() { - _unused_capacity =3D mem::take(&mut inner.freeze_list); + return mem::take(&mut inner.freeze_list); } + KVVec::new() } =20 pub(crate) fn freeze_list<'a>(&'a self, guard: &'a ProcessInner) -> &'= a [Arc] { --=20 2.54.0.1136.gdb2ca164c4-goog From nobody Sat Jun 27 17:08:57 2026 Received: from mail-ej1-f73.google.com (mail-ej1-f73.google.com [209.85.218.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9D0C63F39EF for ; Mon, 15 Jun 2026 12:37:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527025; cv=none; b=Uq96z/XHw2B2mUEMdRIi4mp9tdlOBZ2oWICzfpASHbH0Nii/SWWaqJvIqSOw5qeld9YHou6sB/4V4InfY+tJD7V9VnL+lYWr+uRRP4R44pjWEXP2f0tjcZ6L0jYOFshfjGG0mUt+6EkJaKAW1Fj2ZcJ2VJeIrRMjDisLg/qlRMA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527025; c=relaxed/simple; bh=W/GN17J61uJOqwT6ccMv8DLfa681Ryd+FrRXb1/pB2k=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=JZ2Y4IFMd8EyRHv5Ke+sgSWDGQ2qKfg48wDVjl9bT82YUK8/WfsjDaXFzsS4uQK9TnhhEvi8PVrFaXKYx9FNjmwuk40Cx1FPSVDUfZV3a9k7zrBIgwx2Xl5U1DxTz2HNbo8Ir6CVOXF1DWP/Iy9bb2cdvhLq5py8RURMJBlI7O0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=H7U22f8j; arc=none smtp.client-ip=209.85.218.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="H7U22f8j" Received: by mail-ej1-f73.google.com with SMTP id a640c23a62f3a-bebbba3c343so208862166b.0 for ; Mon, 15 Jun 2026 05:37:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781527019; x=1782131819; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=PMsk5ACWJdbrMJtqBrFN8lRrYOilmz9ty4jGSL7MEp4=; b=H7U22f8jqBE8C/6c3xR2msVcMdeKrFLOlJL5K7B4WkH3FOcyfsV8ChKL6e8KxTDTGp RVIOV2FW+3pF0EJprqSQDXepZhyOiLQYT+YfFrFZ9WfwnDth5m+CiFX4d/4vUn84lifd rDPibw0GG3rO1RXNK0HSTQ4wVKPcnI/XzfYOd7i2sByanlkPNDpLp9vJ8NYM7gUMvAk3 5yStQ84/+RbRrO+DwYMWwb1g7wmedMPU5nNvMedSW4+PqeMRTuF3r3qGm2oj31wYr6yu rFnAC9oN/CUN7Y+Ihd3fTu8eX2jsTXBdWgf+eMEOy8Wwb/yS2gvmbRE52GBTAnSLsPue 0orA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781527019; x=1782131819; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=PMsk5ACWJdbrMJtqBrFN8lRrYOilmz9ty4jGSL7MEp4=; b=YsG1QwA2rg+NUJwOeNxAsnQpkaTB0bCXlhH896wiFuwDjF44TCzcrAT1P17VdrlK3J UrtX1oxqmpjBZxaNu8GJiPlNQRuFL7pJ6E1ebTbXybAmdCoS6QITXUgmLPHthL2nZjWv PFAt7ejnTtwqek7lemlNsyzS+Q6v7lSWUaYo3ODu8UxHcnVBKJ9nv2acBKlFqz0Z3lD8 4VOe+WYb8E51nk4wZrBLPUUYdCI5AEdKrOiFu0RgDsmfX2gBPBX9abmULn+XtZ+KefP+ h6qUoW5kf1GprrHfpXPK0x1DLeqoQll/rnc36ixVb+Z0QJd5WFmm6gBx1NM3ql3BX8ap +L3g== X-Forwarded-Encrypted: i=1; AFNElJ9tZrEYYjrXtHXJJ984q0mdC/iFrZi5KCfrGM9N9EYUFhHNBUl1LRVzQU/17xgufAeJcXgDwmDVV8StRoU=@vger.kernel.org X-Gm-Message-State: AOJu0YztCn3tR18xT0tZpK0AY+XXnu7MPDtqVHNa0Xg3F9ijeel3J26k f2WvbmLln30P3H14Z/TJ22kDz3zJf+uwMWmQGZw0slh5d96hxDub6GpKNObvL4M3ekZ5thHUinf giRQUeNu2j+TouS4DCw== X-Received: from ejei6.prod.google.com ([2002:a17:906:39c6:b0:bec:daff:36d8]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a17:907:2d21:b0:beb:8ab8:30ce with SMTP id a640c23a62f3a-bff4a200875mr445206966b.20.1781527018553; Mon, 15 Jun 2026 05:36:58 -0700 (PDT) Date: Mon, 15 Jun 2026 12:36:42 +0000 In-Reply-To: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=2731; i=aliceryhl@google.com; h=from:subject:message-id; bh=W/GN17J61uJOqwT6ccMv8DLfa681Ryd+FrRXb1/pB2k=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqL/Hl2Sm6/ZSWm6dBjuEA656sm5XiqQTZj6rGt VLEj4qxXKeJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCai/x5QAKCRAEWL7uWMY5 RmojEACVeYEEaLobBIyE3t2e1QON6Ef0qRj+O4qeGJN4qDetmuKEHqRMfTYG+R8MtoBHxlxOm2c QiKv642KRu6cbVP12oFTWyLYZ4I3obwWAv0AEPhOx0+chhAPiYmt7ABbUxG0wIRvYKPv5rDD3Oz aXMDzHc2SjCLui7SYq+9l3cVTKVklqEPwkP1YJ5KqNOr53+Xn6sn0GJRBTQ3V4iOa8EWqLAmJg/ U7gakJsiy0CtdG+CGMlVR2YPvjfqxWmZk24eigDOgGWQdfZl6PwIQX1SKmW+87lsXP4Wn+YqYkM THV1asxpXAgTA0YigzKunh4TMm+xJHCJ4ppzvnQU3+hHUFwYJbgPI0os67FHNYdEM1p0IVBe0vv TDoZC37poTiURDOraN+rlvSWfcMEPOqa8bzsie2vwlWyo0MnerEiWPWR+InYnaXZEwsty/k4LbJ x4ZeTfJGc7qTZJkk/JIJhWUcJcdCpZQglCdRA6b6h1DCX+TDdv9d8IDfbLjC3CGYOjeTkf3AVrF f+QDO795qg4ndYR5O6OP/FUUEeetegKETifho/fJ11tNtbPQu70bK04jvwFXd2TQyYgxaoTEV/B VY5O4CQT5GHCj282rzaV3kXW7CJwkcx0g14POMhjIJfS3pUrahySNP87Ie2inmWLesvQ/DtCfjp bDs9vKQ+GjCSITA== X-Mailer: b4 0.14.3 Message-ID: <20260615-binder-noderefs-spin-v3-2-3235f5a3e0a0@google.com> Subject: [PATCH v3 2/6] rust_binder: avoid dropping NodeRef in update_ref() under lock From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable In preparation for changing the node_refs lock to a spinlock, move the cleanup of NodeRefInfo in update_ref() so that it occurs without the node_refs lock held. This avoids dropping an Arc with the lock held. Furthermore, the NodeDeath field is kept in the NodeRefInfo to be dropped outside the lock as well. The removal from the rbtree is updated to use remove_node(), which keeps the rbtree node allocation until after node_refs is unlocked as well. This is not strictly necessary as it just moves a kfree() outside the lock, but there's no reason to invoke the kfree() under the lock if we can easily avoid it, so avoid it. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl --- drivers/android/binder/process.rs | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index 96b8440ceac6..f4f4d45e1ab7 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -942,13 +942,17 @@ pub(crate) fn update_ref( =20 // To preserve original binder behaviour, we only fail requests wh= ere the manager tries to // increment references on itself. + let _to_free_by_handle; + let _to_free_by_node; let mut refs =3D self.node_refs.lock(); if let Some(info) =3D refs.by_handle.get_mut(&handle) { if info.node_ref().update(inc, strong) { // Clean up death if there is one attached to this node re= ference. - if let Some(death) =3D info.death().take() { + // + // We remove the entire `info` below, so no need to remove= `death` from `info`. + if let Some(death) =3D info.death().as_ref() { death.set_cleared(true); - self.remove_from_delivered_deaths(&death); + self.remove_from_delivered_deaths(death); } =20 // Remove reference from process tables, and from the node= 's `refs` list. @@ -957,8 +961,8 @@ pub(crate) fn update_ref( unsafe { info.node_ref2().node.remove_node_info(info) }; =20 let id =3D info.node_ref().node.global_id(); - refs.by_handle.remove(&handle); - refs.by_node.remove(&id); + _to_free_by_handle =3D refs.by_handle.remove_node(&handle); + _to_free_by_node =3D refs.by_node.remove_node(&id); refs.handle_is_present.release_id(handle as usize); =20 if let Some(shrink) =3D refs.handle_is_present.shrink_requ= est() { --=20 2.54.0.1136.gdb2ca164c4-goog From nobody Sat Jun 27 17:08:57 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4094A3F4121 for ; Mon, 15 Jun 2026 12:37:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527026; cv=none; b=XdfoBu6Rx/VVp1nP1yjMrkpSf4G8owxxMnbM6SM+xrMERBk4BWJ61Dm/+PUfjdsLCVMXIocRRt4nmSsdYufZhx/7TV7peuzRsO3FwX48jK2FCw1wE1+Uij/bRwyMyLUCfQ+90M8RkczH4KcXq4GnMNQfwShHYDcC92N/+Qqia+s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527026; c=relaxed/simple; bh=W2IWb+t74NX9igjCVuyqeHGDLyu5VzRPiMxHaddVGpY=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=PCMaP1olkwpMOV6fvxW4RWSPGKKsT1GZip0p5AWJ7OWQ3ZUKIRYIfUORTxzVFL0/WwOUodmIXa77U45d2HlPjeqpdQ/lFqFDTPRXzIyKwmy4M28aZ3LicPCi6yc2TYt/r6mFvlsnxTEdLdPvAqPhyms3pyiqxrQpmx7faGVfEzc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Jv0fgDsY; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Jv0fgDsY" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-490d3f03883so28293065e9.1 for ; Mon, 15 Jun 2026 05:37:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781527020; x=1782131820; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=HhE7II6bhxRXqbDcn7166lmFn0VZBvJ/2LFtdoZlxmQ=; b=Jv0fgDsYd6jnuEEYAzJpkCWDROftg8SGy0NSueolAVgqZeZIWA/Fi3Tn8ZMvgr65Ju s/wTMJkyx3LeYz1Q1D9C5qQ+W6QkmTif5Y25iInMwgltKUW2eQQVw1EiDSWCSVI8XDTh 2KkoUeVEHcmBp+iglwJWKHvmVnMBWSddZIKWENCHUi+3aeAbijtSrVaCZf18TMI9oq5p gn4gbJntGLk56V4sugcgpTVC4sZZq+1AJkPXMyyOerDl7BpsLKTR6dKjLr5K+miGgKKe MYNu2cAWXrnwZDRorQNty5RmztkiVnNyJtIO9yVpqEe+waks95MOvCM2U4F2UsoHGbIp 9LXg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781527020; x=1782131820; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=HhE7II6bhxRXqbDcn7166lmFn0VZBvJ/2LFtdoZlxmQ=; b=raikemn98JPszslzBJajY7hYhnEFefXAWte/LqJQTopsZiTfQIa0kcI5ZK8st3ErVc kEDe0tmqMJJu4eFOgwLDlS1lM4iIsr2pz9BaNTbQVWBoIXgjuTQ4dpBmex9pNhDuIMCW gv8au7MEcHf6Dl20OKNpzFB/rm2kt5aCtYN6XLoNWa4Sduw90Uxg/WhFpEEX0ynHa3z9 v23JOZ8OpNRuQm07F8Fm+Wg4DEyYU7XG9AgDEQqt+qkOP0QMi2kFAbiDQ9aTf9nbMkMr 7oq3xcENW6jUo/KUbcMW2jTuoq+hWAXRH28UaNNv9s6Wh1SAF84faxSvZqAE1pO5rp0c XSyw== X-Forwarded-Encrypted: i=1; AFNElJ/anKS9Whqo0d8hr63j6RgHSf1t970O83M1ELng7NwR4+9gARmDpNBAfKrV7Xfo9D3JcNmE5og38sBpFME=@vger.kernel.org X-Gm-Message-State: AOJu0Yw138id/LKODahI8LdjFBqVmDX1yMw/GKCdBkFmmSdff6volDxP +aYmhyXmly7GGqnwodmIZkTptCscljYfYUXH5eCQfhQWgRT/WemAc7Z2wY7Et6dUysPbvvWg3hM iMrk3H8neXddQ2EDStQ== X-Received: from wmat4.prod.google.com ([2002:a05:600c:6d04:b0:490:b2a6:e6f5]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:8b18:b0:490:e1a6:25d with SMTP id 5b1f17b1804b1-490ec4fb514mr165979405e9.26.1781527019989; Mon, 15 Jun 2026 05:36:59 -0700 (PDT) Date: Mon, 15 Jun 2026 12:36:43 +0000 In-Reply-To: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=1255; i=aliceryhl@google.com; h=from:subject:message-id; bh=W2IWb+t74NX9igjCVuyqeHGDLyu5VzRPiMxHaddVGpY=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqL/HlOhw+l4ZaXKyTjNHSq0bnBkaPdg5cumqw9 CeYyzTUS6WJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCai/x5QAKCRAEWL7uWMY5 RmWVD/41LJvPWA9ORyeog4rBigWMc6VPAe4jnycM408efPnImnzogX/O0ZmO2Z/8jRmErPeoQSV d8yCIY+K0eaH3z408lS8xDx3ffUf1lOGfys8sHZS+b/fz85BGBvyTJr+GZYBAKxbs9kAwbEE3EZ 0wFiNv9B+HDWQ6uPAmR5g9yTh3EHL3y+mP/2pZoKGLtU0amjwdlgkmVBZB8O85BF9pbsdiOjwWF kDvEBQ4MkZosv8edEIadxjkOZYEgPbGJlCswedIz4eJwF8xTyQqlrkOKInk68U3jBMzhLb39R2a +AH7o0Z85MspuuuygPIxkFfdwhlkIFxSF7wLwrHbRF2SscgBKbCqRBwq8eScmMS2Y9z+DUemigW IaJ/tobbAHj6Obe7A+jVY3C/SBMTaqqSKpQfnNkwfFg2Y2Z05kIebrpbH53vRQvswxx3W5/vedO E30BNv6t5Y7nt+cPmXQuSMvLbh5vZv6NQLtEbR0LGdOLrOrShH4wcbq4VxY+5QTiu+soKvmalMy 4sdTIxMReNBrgskP7+reEHPyXVbiqcdEX20EFr7+Ne0KV8TulnvdV9C2xsPT+4wU4/9k2mNS+Ww YQ3nIbqNEut94zAXJ0IMiWidjRhbYFqhSHGv1rEdBqLef8se+uQhfaB3vD9VDaDstf6c5wxt5Yy yK03tKsml8Ff24w== X-Mailer: b4 0.14.3 Message-ID: <20260615-binder-noderefs-spin-v3-3-3235f5a3e0a0@google.com> Subject: [PATCH v3 3/6] rust_binder: schedule NodeDeath outside of node_refs lock From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable There's no reason to hold the node_refs lock while scheduling the NodeDeath to the thread todo list, so don't. The call to set_cleared() is kept under the lock so that the state update is kept atomic. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl --- drivers/android/binder/process.rs | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index f4f4d45e1ab7..a8836cb8b8cc 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1289,7 +1289,10 @@ pub(crate) fn clear_death(&self, reader: &mut UserSl= iceReader, thread: &Thread) =20 // Update state and determine if we need to queue a work item. We = only need to do it when // the node is not dead or if the user already completed the death= notification. - if death.set_cleared(false) { + let should_schedule =3D death.set_cleared(false); + drop(refs); + + if should_schedule { if let Some(death) =3D ListArc::try_from_arc_or_drop(death) { let _ =3D thread.push_work_if_looper(death); } --=20 2.54.0.1136.gdb2ca164c4-goog From nobody Sat Jun 27 17:08:57 2026 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A4A422E7BB6 for ; Mon, 15 Jun 2026 12:37:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527027; cv=none; b=UIFG0EvLUqDZkKPXOAV0DoY0X53hSAq6kM/fC9ummvBRlzJou+rFohcjftdWor60lQmHSpWsVnxqLuBcIfKUbqbUcGQCcLn6G2mSzd1FKFLHkKL0cEtLxHlI+ADjxVAhida0vR0ZJwdDHIsaY0P9yxWmX6kEP6Xs9JPPTZaQww0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527027; c=relaxed/simple; bh=vM/iNk5W69R92EN+aOfrAxpd8hJQ6DTURkdFhdbVE0s=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=gxVQsruJlXd7l0aiLDD8yV8UVUZpzk1cXcLugEoGyVCFkOMsVvkPlh4ndLZ2S8Ito5PsoWM/Lrw2yuqzliJzhmPJLaEhJProf9KXo3rnPU4EWcSGYl6CO2kbaFlKBvFGZKmtm5wgrbI90L/j/A7OFxaodbICZAHCM/SgSUv2Vuc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=C3xQX89i; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="C3xQX89i" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-490abeb7298so37946295e9.2 for ; Mon, 15 Jun 2026 05:37:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781527022; x=1782131822; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=DVsllswKyB/MpNirpjMlS3W3kzWpJKS+CbEIJ9K0B14=; b=C3xQX89iDLyVZ0Eef0T23jvXH99S7pm0phK1Is/Ib6DkJYIBYPhhgOy/z5zk00asvo iVqbJZCr9grcVy8iLilJKl6HY71TmAAkdy7+TVhnV0T2L5syzE8ayVsK7EB6wlVA0nVT 8BayBh9szNrIMW1JWBcfaKjUTGtCBew7qvIAUS6IxGFGc44kRnvEaClFpZEbzYU8cMIP YTTCiTTZtTKuHwJ0RiAYnqoMoIW3KZjz91GyM0QPU2ps1iaiWPCZqY36/i60E4zRXd8R vT5LvqSC9VvPwH4PyLaMjZUubOccn077u7L7igDc+IIf835b07Rw7qB58lIb2OQ1dm6s OPzQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781527022; x=1782131822; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=DVsllswKyB/MpNirpjMlS3W3kzWpJKS+CbEIJ9K0B14=; b=GVaB48l8lMvavY5z2fEzyQn2+rnEURHAfs4iv6jiq3bjZRkyGkVNylldWf0yVUGhXC 24AY/W8tZLwT4+lfaPOj4xQbRsl9Uehgf5e/atxm9CGjHITYzPb4RoA9KhR3Z0Ud2vvB NNw4vHmYEIjJCbVQ+XDCdQgXdeWpPvUqIANiCfhWIsWQ5e07zboNaTtSIpghsRDeLkwm Xpng+ZjAYUYxu1id1u44b5Nh7s10YfcZ+9CaeRfUGT8Yaujr7ICcTTr1NRPhqRYsDqnj V3kYf5E34ZbR5+H7AdJFSYy328NGxqRvuTE8aB+qxC2HB6ZN9AaUV3FPDxvY+tbyHNcx BJ+Q== X-Forwarded-Encrypted: i=1; AFNElJ9Tx44cBmKIpAXnOUbQ48bRPO2K9JQIPc1QC5SV/0uZFHZwllnHwNpqZWrarqe9D0kAGSLEbKHrEX2LHIE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw7DOn9CEYPh1rXhUv02SbDOO3oEL2cB6v+ez87QK0bvlcOrNq5 rUw71ydaTknNnKIFsMXYowm4r3GWoyaDAShKlA0ZKn/T+GwOOzNiSqjF0RNrtRPyeXlQAbIik3f Zqv7gbFCh85kNHqGr/g== X-Received: from wmbc22.prod.google.com ([2002:a7b:c016:0:b0:491:41a:40d4]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:3f18:b0:490:add9:7f88 with SMTP id 5b1f17b1804b1-492200dc927mr130901295e9.21.1781527021395; Mon, 15 Jun 2026 05:37:01 -0700 (PDT) Date: Mon, 15 Jun 2026 12:36:44 +0000 In-Reply-To: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=1616; i=aliceryhl@google.com; h=from:subject:message-id; bh=vM/iNk5W69R92EN+aOfrAxpd8hJQ6DTURkdFhdbVE0s=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqL/Hlmd9oHM7e1cGIOeotnIe9rsRqd4kIxeRM0 8H/aTqGQyqJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCai/x5QAKCRAEWL7uWMY5 RmGVEACBDSSmpAqdH1VJW8Kac/7bzxygFM49675I1Rt0xo05rD9+8EdYGaa3n1wMa8mgymRr02V yE+r8Q7EguKPtFeflxM/xESnYWtElaUlyRPT6w0h1gofLNRi6JcpkA4EV6NmwxMfALeFIGOYYoM UiIujkWUHg4xWCVrJhem6zksrkEBMYhdT+D8MJWLM56aORp8l33qko5tbiFSnwaswyEDNVkNVZB izefx+U6rXsWX+exRU2ux2ihGfG/pSP5z6b+nSrlLrTzGtFt+Bput+HcIUhwxk65P77Re/bvXYA 4gf+6xBS0InLHdElTV4QkSpidqc7orP9Y26lHArKGOE0Sp3RV8PcLANCFD1vHIxJaL+NWCHREo1 pkgMjL7KqnZYaZ0sdKxzV413h6KdQjPdH4oWhQDrEN8VlWj19nEChLzQdRCOVRE6E2vqXzgoJ10 KMAOONUc0moQVLWaN7Px9ogy/+zvNxSMamXPc14G8ze2rXW8gQQX7R3FvbmMhpWyg7KmtZmVhzP 7HNHREMMMTyfBXFExZyXA6KgSnFRMS80Ma9CfFZf9kgq5MvJLMb7/C8fCqVnH6Erh23jddxt0WH 0+mNtx4Z20F4Gc+n43JhbPAYHJ1s8jr/aBqpr7c/+QKQaEqE4Guabh4mczrg3u1h7uvTSLQ79x/ KPyez5tWMEKvNgg== X-Mailer: b4 0.14.3 Message-ID: <20260615-binder-noderefs-spin-v3-4-3235f5a3e0a0@google.com> Subject: [PATCH v3 4/6] rust_binder: keep NodeDeath in NodeRefInfo during process cleanup From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable By keeping the NodeDeath inside the NodeRefInfo structure during process cleanup, we avoid running its destructor under the node_refs lock. It is still dropped shortly thereafter when the entire rbtree holding the NodeRefInfo objects is dropped, but that occurs outside of the lock. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl --- drivers/android/binder/process.rs | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index a8836cb8b8cc..c8e9fd0d0472 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1375,13 +1375,11 @@ fn deferred_release(self: Arc) { // SAFETY: We are removing the `NodeRefInfo` from the right no= de. unsafe { info.node_ref2().node.remove_node_info(info) }; =20 - // Remove all death notifications from the nodes (that belong = to a different process). - let death =3D if let Some(existing) =3D info.death().take() { - existing - } else { - continue; - }; - death.set_cleared(false); + // Clear death notifications from the nodes (that belong to a = different process). + // No need to remove them from `info` as we clear info below. + if let Some(death) =3D info.death().as_ref() { + death.set_cleared(false); + } } =20 // Clean up freeze listeners. --=20 2.54.0.1136.gdb2ca164c4-goog From nobody Sat Jun 27 17:08:57 2026 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E3ACA3F4DDE for ; Mon, 15 Jun 2026 12:37:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527029; cv=none; b=ajtSwNzsSh8BalN/i+uUwUps5Njcdk60DVn/M7jHztCZn5WUxBMO6WaBkzz4VpMGUn/k435BqGyPeC9D0i2hHhrEX/tCZOCdKwNKAwGRvIMbwiUMlPB7WCNx/VHiy4/57nX1PULfvND5Xskvx0ImBoGk/yZXjPbJEI8vMLDVWpI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527029; c=relaxed/simple; bh=v5t7p4vMz41Oop9uHooe4i69haiDp+a/7ITddzkXaWs=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=TrtsZsFaEDbKsn0qW7b748rvR0SxHOFotr8Z5nhoEp/fovS2Pl+2TXcvBN1u8XWJwwzWN1HzkRV/yBKLvHscamBq0gleCLXEloyHCRFOEP0M1YOf4WbuYaDknKx1CCFOz6+4Lb34wWHs7r1NiO9Kg4pcv2eiKR4Q/dT7lbGha3c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=l/dqAbjG; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="l/dqAbjG" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-490b79e6b94so29354675e9.2 for ; Mon, 15 Jun 2026 05:37:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781527024; x=1782131824; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=F7DjiVX4fhURdXgr6E+XvoPlZztE4a1mjK7EeHBg02Q=; b=l/dqAbjGXiPVX4nv397YnywgPp+9qFCVQk4u1QcWmH+pLazbNHvUYLZPsZX86gfWvZ wdrqdhzXHzuXX7lMHQlzxJRYhDHUe8CxX0yrZ5p7Uqz3qnTVuA3ZOyi6NbN2Jhy5nC7n Gtjx8/o3x0Uk1AX1gA9gtT+UMW70T/AuNmgx7OflKZCOe3DZaU8zBQ1foD54UJfL6yPm dKu5el/oh7IM/jnJgnzCrdpa3mRFJ+dDz6y80xWNsrip/I0Xe5aE8LlaBOlRzqASuvqt mxW8L8GUG5hOdaQyXwOOZH+6yDvRdHLE0ZlmexhULfq2mB7czqU6k9W2levy5CE3UoHA p9qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781527024; x=1782131824; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=F7DjiVX4fhURdXgr6E+XvoPlZztE4a1mjK7EeHBg02Q=; b=i0TIkBpo+XuXiSiRA+/hcXd/Kkf5IZ9sVTCxmkB8imFEsytUmPwFZazrP9AyehIrr9 BIuGTpcJZ7DO/EsdyBZHOQPVppgLOZPR8AvAovv5QxdBch8/9aKoi82HX1XOIn95820a lZHsCH7PTvvVizjDPyoFPLWjED70VWjWMUPAemroX8q2xveqMn5h0mz/sHlVO4Z+JJVB zvZZ4bdOcWYUXEDok28ycI2KiNk59xyfV28UTb7cDUzgHnb6HwwssnXlgsD6lLwgAPy9 xEyIeTK9n3ZKhLIjxwYzsrbeKmRE3RyXfSrF3VksvpnMCRYsRrI2B/Sg8FUcXSYlS/F/ 1OIA== X-Forwarded-Encrypted: i=1; AFNElJ+SUgOA8E/dSYOx9wkHm365jTmBUtE0IGRZ6EDsr2JCWJQMNk/NYPKLlagAQQgQuyUf1eHNv5hYoDLw0mo=@vger.kernel.org X-Gm-Message-State: AOJu0YwOi5mssvRGlSEvIMadHMJDHB65Ml3LK8A0zl/vbIXzMNMRxt14 hLo3b1aaxWYizpU9ttkOeYLcO4HkGuxr2EJ2oLmCV/kh8S4aQFjz15peUQLyrqgCCR74svtjZmM s7pMyaQphf4+LG8vKuA== X-Received: from wmol19.prod.google.com ([2002:a05:600c:47d3:b0:490:ae3b:b7c9]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:138e:b0:490:d354:bd00 with SMTP id 5b1f17b1804b1-490ec507db7mr191879175e9.25.1781527022932; Mon, 15 Jun 2026 05:37:02 -0700 (PDT) Date: Mon, 15 Jun 2026 12:36:45 +0000 In-Reply-To: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=3164; i=aliceryhl@google.com; h=from:subject:message-id; bh=v5t7p4vMz41Oop9uHooe4i69haiDp+a/7ITddzkXaWs=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqL/HlbZG5QEjm+0qIwyUbajMurmMwxcfOdqU2w bFBKNN+nI6JAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCai/x5QAKCRAEWL7uWMY5 RqSJEACoG0jUUPrRL2rfE+L6LdLUR2Z7oZxAh9U6GrxvaPBeoXA5AjnpjNZGsbSGJeFmx13/FZa EkJzTSMR12qGuDhdaf6CBCrFWbV0IsnMi+YIP5LOR0LtAr+fE+MQhfJzGTkJByunsSy+qKbTqO/ pVdTysqeOQXGVTfGls6LxJQ/f7YQbabworj2TDz8/80tLAsChIuRtmzoTqOql3sqIChHxEnqTad RhyqfHIKmITnkbhV2wAA7HR7ruilwGI9canC2tR0GMZ083rSRm9WRGDnWNTVY7LYnxZvjLsExjR k74yQoPoABkUNyjO3YeuBJdfYka70uwWDhvAYOH77qrOM8PeJOgC/QVN8xgs6oeTQO8KcBH/lKa fm5kP3LIt91+BdXo8v9FiMAqx32ytmkZCiT08eeI0NAjByAj9qVS7YgQmeRYOvAupmTr6yWS79F Gu2ZBgJRdOlQQCgCqfg0oK3OGeU2RGyCvZ3+ihyaY06Enihrw1Ygkz4nSq1hrJ3pEKi/9epPTLq pKt/k89tgjfqwWkKKeI8vPhTAGjGfB8AhB4jlVCqhRy4VrJJgWaFpZcWobRQ9vvV/S8bBbRmwh/ Z4hE7ZDRhTiIejXI+iwK1xxzbH+jljR7r4XPbzlB1pd4r6UJIj45eDWBmwhwUMR7cq30Xcgxfkh a8YzPl/91R0l4qg== X-Mailer: b4 0.14.3 Message-ID: <20260615-binder-noderefs-spin-v3-5-3235f5a3e0a0@google.com> Subject: [PATCH v3 5/6] rust_binder: avoid destructors in insert_or_update_handle() From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable The insert_or_update_handle() function currently has two places where it drops objects under the node_refs lock. In preparation for changing node_refs into a spinlock, update the code to either entirely remove the codepath or drop the node_refs lock first before running the destructor. This also has the side-benefit that we avoid traversing the by_node rbtree twice. Currently it's first traversed to see if the new node is present, and then traversed again to insert it. By saving the VacantEntry from the first lookup, we can perform the insertion without traversing the tree again. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl --- drivers/android/binder/process.rs | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index c8e9fd0d0472..268d78f8cfb3 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -861,14 +861,17 @@ pub(crate) fn insert_or_update_handle( let handle =3D unused_id.as_u32(); =20 // Do a lookup again as node may have been inserted before the loc= k was reacquired. - if let Some(handle_ref) =3D refs.by_node.get(&node_ref.node.global= _id()) { - let handle =3D *handle_ref; - let info =3D refs.by_handle.get_mut(&handle).unwrap(); - info.node_ref().absorb(node_ref); - return Ok(handle); - } + let by_node_slot =3D match refs.by_node.entry(node_ref.node.global= _id()) { + rbtree::Entry::Vacant(by_node_slot) =3D> by_node_slot, + rbtree::Entry::Occupied(handle_ref) =3D> { + // The node was inserted by another thread while we didn't= hold the lock. + let handle =3D handle_ref.get(); + let info =3D refs.by_handle.get_mut(handle).unwrap(); + info.node_ref().absorb(node_ref); + return Ok(*handle); + } + }; =20 - let gid =3D node_ref.node.global_id(); let (info_proc, info_node) =3D { let info_init =3D NodeRefInfo::new(node_ref, handle, self.into= ()); match info.pin_init_with(info_init) { @@ -884,6 +887,9 @@ pub(crate) fn insert_or_update_handle( // first thing in `deferred_release`, process cleanup will not mis= s the items inserted into // `refs` below. if self.inner.lock().is_dead { + // Explicitly drop the lock so that `info_proc` and `info_node= ` are dropped outside of + // the lock. + drop(refs_lock); return Err(ESRCH); } =20 @@ -891,7 +897,7 @@ pub(crate) fn insert_or_update_handle( // `info_node` into the right node's `refs` list. unsafe { info_proc.node_ref2().node.insert_node_info(info_node) }; =20 - refs.by_node.insert(reserve1.into_node(gid, handle)); + by_node_slot.insert(handle, reserve1); by_handle_slot.insert(info_proc, reserve2); unused_id.acquire(); Ok(handle) --=20 2.54.0.1136.gdb2ca164c4-goog From nobody Sat Jun 27 17:08:57 2026 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4938A3ED5C5 for ; Mon, 15 Jun 2026 12:37:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527029; cv=none; b=GrYpJfi79Q4XBu4yL3Phz/znK2yVfGbbJyQx0iZmnGVdblC6QQw2R2MQwEzHSrd/SNAZGG9YbGmGU8JFuvdH14NlgLWboxAI+weZ6dUsMjSPjdi/fAYDCjB3ehr2CRyKuqMhwzuA1HeAn+9E2K59ATY41M1cLbbNcxadTJ9Dtm0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781527029; c=relaxed/simple; bh=pRWHCKfc9EIDv8OD6Ag8tpxvHh3fSgM2IuS8g8uBlKs=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=bgYLcRTSpubNrJI5EHK8wz5rbeCeujP7bXciNqHU3D3k4AP+ARj4uVBmqmlIcXa3qArq5LZpDblnidCfkFeuiH0yNNPj9buZLHmvNaLtqNAg5m1uD5SPu5pL6FVEy6iuxstdADorZ3Qs2+LlHAJ3vw3IvVPEy6toJtQFxAeGvKw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=IRk11mmp; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="IRk11mmp" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-490b3ec3f7fso19967855e9.1 for ; Mon, 15 Jun 2026 05:37:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781527025; x=1782131825; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=RNmtccmn4gsPTWx69maePoOlG2Lp/iRYXLRtIHek0ps=; b=IRk11mmpW3WN5aaRGKMI32OmiaOoTe+w1si9RNkfx7sWN6tT8jVeNN9TVu6f30Meaz sOYhrT4T2HNopLchQxChtVCYGnpUfR/f6glzsw9gOKTqSiBJOlzEU31ijeDtO/zpmMQk VXzYQpflbtqFs7kP/W5j8LW0KxBJ1sogpZvHvsLUaLG+R5AUQfT7zOTUmPEzXoWWHbfK KvSfL1OEQuIUGGrY4ZRO67L1JenKPbmtw38qOrWNDFyM0kLdB5veR5mpx6nu+LtwkqKu A8+5HMqRZTHgn5uf34Pdg1C7ICf2kmKWDHNXPYsdSYMKX9+VfgCcW7t4RqWWwGixy5++ 529Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781527025; x=1782131825; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=RNmtccmn4gsPTWx69maePoOlG2Lp/iRYXLRtIHek0ps=; b=pFaoA+0WasuGEEFzb0l+8qdgr9HM9zPBpZnQcFPuYz1Dgomb/IeqvGnwysPurFNfjr uTGgHcScMwU2wawrOUMSG0RloAK5Ho2q7Usn60+8PE069cQmjUwX+CiVTn0SEdw1nxRm l4nmU53/ZwCUhElM089bC+axtBl41nrvjszwsHR1e13NFFq5PUZlJQjwhdKWPyFgWpu+ +D+GzTgz2xZol6yLgZCisEuX6y+U5NyOD5Nf0XJeU9j+Bn6mJgOtnazMaCqQOstFwGAl oQg4KLGV4pggkk3q01CiflgXDaR01ji8tKTZzJ8n2oiKTyvXXvJ9TecUwi5O/Ab+/DGy jxzg== X-Forwarded-Encrypted: i=1; AFNElJ/D5+vbGl1JoaMy6VXlqpxUqlYDzlY0zvUSsulN0DG7Ov/bAV8w0DoKjRsSfT9kRsIaah5WcRtC86OTPIo=@vger.kernel.org X-Gm-Message-State: AOJu0Yw98RnvLC1o95Jgqy/gcwL9fV8jPoaAB1qOsjw2Bc5E2z5pBVvD urkKiIiDr3Ku3C/TsMqPGD8EiZC1z0dR47tVGk+eNsZejCIiaxaRKnTfb9CjLvciGqaH3y93GqT eosJtUmk4zPD6DUKchw== X-Received: from wmv21.prod.google.com ([2002:a05:600c:26d5:b0:48a:79a9:335c]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:8b31:b0:490:e5c1:b8c6 with SMTP id 5b1f17b1804b1-490ec4b58ffmr188426625e9.8.1781527025206; Mon, 15 Jun 2026 05:37:05 -0700 (PDT) Date: Mon, 15 Jun 2026 12:36:46 +0000 In-Reply-To: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260615-binder-noderefs-spin-v3-0-3235f5a3e0a0@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=2264; i=aliceryhl@google.com; h=from:subject:message-id; bh=pRWHCKfc9EIDv8OD6Ag8tpxvHh3fSgM2IuS8g8uBlKs=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqL/Hl1X0RgSrcndvnol2F3a+0v017sD4BwkVDB IvSuIzXN6eJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCai/x5QAKCRAEWL7uWMY5 RhkuD/9/jr/IWWLyIfB5WJ9HV4oxIJfvJfIXimQpjmIYPf6oVPGOuoepGheTKSca2MSBwG6intq nleqrmRItTGEkk13zaKX+pLFVrww2Iem+hQHk+AllCePeqxQy215WF015iBMlKPIvN5U/uv6og4 bLxdPUDjYsuv6Vfwj3QDCL9R7UbBkQDbRuzwoKigaioxqUKmB9ZwY9NcTZS3pZpuQvb9y6iUzgs p/mOux+Z+sy9cm6j4IVjhW3ACf+x9wT/B3SXs2t20PbZtfbM9nnwYeaZdK2dVXxzLjI9osLIt2W Zd4ybvvfNbtnoh9vW8YWVVGH4F/I7EZs0etMXjU2DTum2oQMGEYP1c20eFIeC+qxEo8mdTeuId1 6fGArzKft28cMhtJEl6wPLANeiI3F3B+/Ye9PlMTjjGbK7BSJ3nJtZLsAUzcgn7yJ5YmmLjaRH5 SdxLzsIYfUhGKu65IIWY16Wrd1ooiRIB8oORwvu25oZpY/FEjLbW9c0YSWr8ghhaAwB0QM4o8U5 D6jWrySdUP1lAYmit99i8HAKX59mlzbUGF8Mn7KrNa6gwWOOm8KPx2GmRf73YuUuU1lVBdTrHKV OO9wziwV7qlw5M9cdZCTo6mhIFFTMPAybhWb1wO+1m2BQV8OPoIdjU1psB1joUNllzJ9fMu4z10 X7GY1/wOJ+Cwsjg== X-Mailer: b4 0.14.3 Message-ID: <20260615-binder-noderefs-spin-v3-6-3235f5a3e0a0@google.com> Subject: [PATCH v3 6/6] rust_binder: update Process::node_refs to use SpinLock From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Matthew Maurer Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Unfortunately the current use of a mutex for this lock leads to priority inversion. Traces have been observed where a process is trying to obtain this mutex for 22ms, but it's unable to do so because the thread holding the lock is scheduled out. Since this occurred on a UI thread, that is an extremely long delay. Code paths that might sleep under this lock have already been updated in patches leading up to this one. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl --- drivers/android/binder/process.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index 268d78f8cfb3..82c34a93660e 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -30,7 +30,7 @@ sync::{ aref::ARef, lock::{spinlock::SpinLockBackend, Guard}, - Arc, ArcBorrow, CondVar, CondVarTimeoutResult, Mutex, SpinLock, Un= iqueArc, + Arc, ArcBorrow, CondVar, CondVarTimeoutResult, SpinLock, UniqueArc, }, task::Task, uaccess::{UserSlice, UserSliceReader}, @@ -455,7 +455,7 @@ pub(crate) struct Process { // Node references are in a different lock to avoid recursive acquisit= ion when // incrementing/decrementing a node in another process. #[pin] - node_refs: Mutex, + node_refs: SpinLock, =20 // Work node for deferred work item. #[pin] @@ -510,7 +510,7 @@ fn new(ctx: Arc, cred: ARef) -> Re= sult> { cred, inner <- kernel::new_spinlock!(ProcessInner::new(), "Proce= ss::inner"), pages <- ShrinkablePageRange::new(&super::BINDER_SHRINKER), - node_refs <- kernel::new_mutex!(ProcessNodeRefs::new(), "P= rocess::node_refs"), + node_refs <- kernel::new_spinlock!(ProcessNodeRefs::new(),= "Process::node_refs"), freeze_wait <- kernel::new_condvar!("Process::freeze_wait"= ), task: current.group_leader().into(), defer_work <- kernel::new_work!("Process::defer_work"), --=20 2.54.0.1136.gdb2ca164c4-goog