From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 85BE033BBCB for ; Fri, 29 May 2026 13:29:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780061378; cv=none; b=INXkPNQm8lOBfdu9n/gA2bGvX49nEGxUWImiEanjnWivjxWN4m/3+oYQWDfB8cQD6uTdsp1K2kbPeZkLN0WCsPxsPZz+00Yr4A1e6h27L6ZDgKNZ9osFBAvCRJgnSNPs7vwWVJL5Astsx/sxvhoW5MsjadLc4d7CCIVosFzRbFI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780061378; c=relaxed/simple; bh=CkLNFLQoIejZn1R53j9upetRYQ373u30vK6NJJ/HCo4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=khb2k7D4wePPESbqTkgnlsp+PvwtzHZsMlnhMT39G9F4QmeKEirHp7GpXm4xuyqHGppYRlQcqSLu5+1+eBpfrsF55/KUJepJC605/Vd2kt5R55K0NGdBibPRoED4w0eQiCaYnFSZZyErvNP+kipfEurIhGaqgx0bjHVYr5inWGc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=SoxiBUKs; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="SoxiBUKs" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-48fe6894f3fso86911795e9.2 for ; Fri, 29 May 2026 06:29:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1780061375; x=1780666175; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=xHhhVn4vsW86m1Qo+CSANVQihzAV4jC69efY1gMDYX8=; b=SoxiBUKs1DDsBdT2Ef5Pz01DPqkPumNhd+oaxXEsiGFmvT3JMAlRl+/1nWBlqKD+85 Ur2GdSkpqvipSUSUTSEhzkS+Q07gfs0mI+0BKt4rk6cn4Z58BRZSYYLtdWt9r7micDeA qsbI5XaarhPzuRSdBqmBXgtGI+t60teTcUqGBZykvETnQ/nPx75zoI0OfoxGDILZIcgi 9kD6ChKMlMH27RZPa24isaV2D2lr6xNt9PLwcvkYkyX+827vdgcM765Exst+/GUIx1Rd /rpC9LxmzgfR7UxsdUGZTEu5YkXH2iThHx8hONoBBrOztRNqewcmTHC9z1M4x58DS7q8 kxzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780061375; x=1780666175; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=xHhhVn4vsW86m1Qo+CSANVQihzAV4jC69efY1gMDYX8=; b=gkSc5R5efaaLngsgemMQ/GaWYuncwfGbOqDW4cDpRYrRBHTEDObvI+J/JleV+sjlfO lI5Q2MunVBLiAK3T/jm7dE1F8e//AalUJKaHeg04mxOCBM3oYCjDXgSGHVvtuGWY3zwx cBBsFIJOesn6370ugwWAH3z7djoq7WNMVgJWZJ9vqa1XQ9tx0kcexncCcXSscxo42zu7 AeFh0hBCaqv11QxEKR3dfzQDCR6Y7bUXUtTjcaYGC9ZCmpaFL+9it3//xHVtN2EoKzgO 2kl0wo89KcGaaCzKdv0CpKpj80f37CRCmfJrGgubYaVVzpteSMcIUQenSSAySav01+vs 96NQ== X-Forwarded-Encrypted: i=1; AFNElJ82wuLgHT61tXXJSyVmXdmXlwK35FcvpUpcmFYL25C//A2ceG2PS8ecAsT/E8bk0u/jUxsgB4n+ROwb7DQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzRrMHwmtcKRnA/LAsiC2O1RUVymxH1c1aY8LOZAAhYi6y962q3 9y4mDc4HE/IPQfjA4yZrozHVRMuaDjkAP8lJiLzHQjnucO7cuXInJPbuYytWza8kTDDbmI6vcCU aLpiDjMqOZrLczZEaVw== X-Received: from wmbgx17.prod.google.com ([2002:a05:600c:8591:b0:490:11e5:b5aa]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:e489:10b0:490:9804:afdc with SMTP id 5b1f17b1804b1-4909c0b9586mr38507975e9.23.1780061374856; Fri, 29 May 2026 06:29:34 -0700 (PDT) Date: Fri, 29 May 2026 13:28:40 +0000 In-Reply-To: <20260529-binder-netlink-v6-0-92dd74b6a32e@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260529-binder-netlink-v6-0-92dd74b6a32e@google.com> X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=11751; i=aliceryhl@google.com; h=from:subject:message-id; bh=nRyqKbtrahdGEfuNVDlkowtAO1l90fpVZ9tCOqHlNa0=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqGZSqk1tyiKegjAxOAAC2Kcc512v48b5eC7z3o HJtUF2rsTyJAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCahmUqgAKCRAEWL7uWMY5 Rm/FD/9zhMA18YbeLCfnWk4v9OG5fX0xyWUWcoqwGUWF1Ze64dXrPNPq+FBSfIRYR76oPpNnK5N nAuGbS82gLThJMM10/Aq9w1Eg6SViQ1SHthyAD8ZnkwrRwYmGuuUIE2RbZu7vMZKjJ+GHZwFM6M 9h9fLPs4xnLBRp5/LaECVfRoy7tG3AHl5/URad6VGYAdbNIb58Y599lKMjrA98xxssPLlYQ7ziO RcbaaRMFaUoJWi/udgjqc+8ghIRAhcET8/aYsOdWrVX3kyRIEeKpWe33AJpotrFOAaJc/eXCRZu YYuakVZaisS9seQZlHIO/VCcudTziVYeywxg1SaQmbQUSfmfcf7cDDhnirQy0ryoQtzCVXmlOq8 tvK3qg4xAQNXiFezliDgbGZvCxIHOdth3fT0LN4C+Tlzl6a0KBqHxhfliyOWYSf5Cl2WiwVPav+ pB6SR2R3dZpgkCVewr01byEWFYsvePXENBM3lvnGtfstW9Dw4F+myIHPDQmA97nkuRLW3ofYGja 9BpCGbW6M6wbaXjeyek95NLmMcKQseQiDb1NGuBBZ9k/Myvr2zOhPq2scZnQ5UIT2fSDUcbgjHV hHvt4foePGyY3zzTWc/DdU3RM4X86/yeAzzihnqH0jRSsS80uYfDkp3LgP+NKx9Vz9DlsBEggS3 zz13KgOGTFoDVjQ== X-Mailer: b4 0.14.3 Message-ID: <20260529-binder-netlink-v6-3-92dd74b6a32e@google.com> Subject: [PATCH v6 3/3] rust_binder: report netlink transactions From: Alice Ryhl To: Carlos Llamas , Greg Kroah-Hartman , Andrew Lunn , Donald Hunter , Jakub Kicinski , "David S. Miller" , Eric Dumazet , Paolo Abeni , Simon Horman , Matthew Maurer Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Christian Brauner , linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, netdev@vger.kernel.org, Alice Ryhl Content-Type: text/plain; charset="utf-8" From: Carlos Llamas The Android Binder driver supports a netlink API that reports transaction *failures* to a userspace daemon. This allows devices to monitor processes with many failed transactions so that it can e.g. kill misbehaving apps. One very important thing that this monitors is when many oneway messages are sent to a frozen process, so there is special handling to ensure this scenario is surfaced over netlink. Signed-off-by: Carlos Llamas Co-developed-by: Alice Ryhl Signed-off-by: Alice Ryhl --- drivers/android/Kconfig | 2 +- drivers/android/binder/netlink.rs | 117 +++++++++++++++++++++++++++++ drivers/android/binder/rust_binder_main.rs | 8 +- drivers/android/binder/thread.rs | 11 ++- drivers/android/binder/transaction.rs | 40 ++++++++++ rust/uapi/uapi_helper.h | 1 + 6 files changed, 175 insertions(+), 4 deletions(-) diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig index e2e402c9d175..606a9d07f774 100644 --- a/drivers/android/Kconfig +++ b/drivers/android/Kconfig @@ -16,7 +16,7 @@ config ANDROID_BINDER_IPC config ANDROID_BINDER_IPC_RUST bool "Rust version of Android Binder IPC Driver" - depends on RUST && MMU && !ANDROID_BINDER_IPC + depends on RUST && MMU && NET && !ANDROID_BINDER_IPC help This enables the Rust implementation of the Binder driver. diff --git a/drivers/android/binder/netlink.rs b/drivers/android/binder/netlink.rs new file mode 100644 index 000000000000..beb7ea2edaff --- /dev/null +++ b/drivers/android/binder/netlink.rs @@ -0,0 +1,117 @@ +// SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) +/* Based on: Documentation/netlink/specs/binder.yaml */ + +#![allow(unreachable_pub, clippy::wrong_self_convention)] +use kernel::{ + net::netlink::{ + Family, + GenlMsg, + MulticastGroup, + NetlinkSkBuff, // + }, + prelude::*, // +}; + +pub static BINDER_NL_FAMILY: Family = Family::const_new( + &crate::THIS_MODULE, + kernel::uapi::BINDER_FAMILY_NAME, + kernel::uapi::BINDER_FAMILY_VERSION, + &BINDER_NL_FAMILY_MCGRPS, +); + +static BINDER_NL_FAMILY_MCGRPS: [MulticastGroup; 1] = [MulticastGroup::const_new(c"report")]; + +/// A multicast event sent to userspace subscribers to notify them about +/// binder transaction failures. The generated report provides the full +/// details of the specific transaction that failed. The intention is for +/// programs to monitor these events and react to the failures as needed. +pub struct Report { + skb: GenlMsg, +} + +impl Report { + /// Create a new multicast message. + pub fn new( + size: usize, + portid: u32, + seq: u32, + flags: kernel::alloc::Flags, + ) -> Result { + const BINDER_CMD_REPORT: u8 = kernel::uapi::BINDER_CMD_REPORT as u8; + let skb = NetlinkSkBuff::new(size, flags)?; + let skb = skb.genlmsg_put(portid, seq, &BINDER_NL_FAMILY, BINDER_CMD_REPORT)?; + Ok(Self { skb }) + } + + /// Broadcast this message. + pub fn multicast(self, portid: u32, flags: kernel::alloc::Flags) -> Result { + self.skb.multicast(&BINDER_NL_FAMILY, portid, 0, flags) + } + + /// Check if this message type has listeners. + pub fn has_listeners() -> bool { + BINDER_NL_FAMILY.has_listeners(0) + } + + /// The enum binder_driver_return_protocol returned to the sender. + pub fn error(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_ERROR: c_int = kernel::uapi::BINDER_A_REPORT_ERROR as c_int; + self.skb.put_u32(BINDER_A_REPORT_ERROR, val) + } + + /// The binder context where the transaction occurred. + pub fn context(&mut self, val: &CStr) -> Result { + const BINDER_A_REPORT_CONTEXT: c_int = kernel::uapi::BINDER_A_REPORT_CONTEXT as c_int; + self.skb.put_string(BINDER_A_REPORT_CONTEXT, val) + } + + /// The PID of the sender process. + pub fn from_pid(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_FROM_PID: c_int = kernel::uapi::BINDER_A_REPORT_FROM_PID as c_int; + self.skb.put_u32(BINDER_A_REPORT_FROM_PID, val) + } + + /// The TID of the sender thread. + pub fn from_tid(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_FROM_TID: c_int = kernel::uapi::BINDER_A_REPORT_FROM_TID as c_int; + self.skb.put_u32(BINDER_A_REPORT_FROM_TID, val) + } + + /// The PID of the recipient process. This attribute may not be present + /// if the target could not be determined. + pub fn to_pid(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_TO_PID: c_int = kernel::uapi::BINDER_A_REPORT_TO_PID as c_int; + self.skb.put_u32(BINDER_A_REPORT_TO_PID, val) + } + + /// The TID of the recipient thread. This attribute may not be present + /// if the target could not be determined. + pub fn to_tid(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_TO_TID: c_int = kernel::uapi::BINDER_A_REPORT_TO_TID as c_int; + self.skb.put_u32(BINDER_A_REPORT_TO_TID, val) + } + + /// When present, indicates the failed transaction is a reply. + pub fn is_reply(&mut self) -> Result { + const BINDER_A_REPORT_IS_REPLY: c_int = kernel::uapi::BINDER_A_REPORT_IS_REPLY as c_int; + self.skb.put_flag(BINDER_A_REPORT_IS_REPLY) + } + + /// The bitmask of enum transaction_flags from the transaction. + pub fn flags(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_FLAGS: c_int = kernel::uapi::BINDER_A_REPORT_FLAGS as c_int; + self.skb.put_u32(BINDER_A_REPORT_FLAGS, val) + } + + /// The application-defined code from the transaction. + pub fn code(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_CODE: c_int = kernel::uapi::BINDER_A_REPORT_CODE as c_int; + self.skb.put_u32(BINDER_A_REPORT_CODE, val) + } + + /// The transaction payload size in bytes. + pub fn data_size(&mut self, val: u32) -> Result { + const BINDER_A_REPORT_DATA_SIZE: c_int = kernel::uapi::BINDER_A_REPORT_DATA_SIZE as c_int; + self.skb.put_u32(BINDER_A_REPORT_DATA_SIZE, val) + } +} diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs index dc1941cd2407..0dc62ac440ec 100644 --- a/drivers/android/binder/rust_binder_main.rs +++ b/drivers/android/binder/rust_binder_main.rs @@ -38,6 +38,7 @@ mod deferred_close; mod defs; mod error; +mod netlink; mod node; mod page_range; mod process; @@ -288,19 +289,22 @@ fn ptr_align(value: usize) -> Option { // SAFETY: We call register in `init`. static BINDER_SHRINKER: Shrinker = unsafe { Shrinker::new() }; -struct BinderModule {} +struct BinderModule { + _netlink: kernel::net::netlink::Registration, +} impl kernel::Module for BinderModule { fn init(_module: &'static kernel::ThisModule) -> Result { // SAFETY: The module initializer never runs twice, so we only call this once. unsafe { crate::context::CONTEXTS.init() }; + let netlink = crate::netlink::BINDER_NL_FAMILY.register()?; BINDER_SHRINKER.register(c"android-binder")?; // SAFETY: The module is being loaded, so we can initialize binderfs. unsafe { kernel::error::to_result(binderfs::init_rust_binderfs())? }; - Ok(Self {}) + Ok(Self { _netlink: netlink }) } } diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs index 97d5f31e8fe3..25ea01ce9ecf 100644 --- a/drivers/android/binder/thread.rs +++ b/drivers/android/binder/thread.rs @@ -1246,7 +1246,6 @@ fn transaction(self: &Arc, cmd: u32, reader: &mut UserSliceReader) -> Resu self.push_return_work(err.reply); if let Some(source) = &err.source { info.errno = source.to_errno(); - info.reply = err.reply; { let mut ee = self.inner.lock().extended_error; @@ -1263,6 +1262,15 @@ fn transaction(self: &Arc, cmd: u32, reader: &mut UserSliceReader) -> Resu } } + if info.oneway_spam_suspect { + // If this is both a oneway spam suspect and a failure, we report it twice. This is + // useful in case the transaction failed with BR_TRANSACTION_PENDING_FROZEN. + info.report_netlink(BR_ONEWAY_SPAM_SUSPECT, &self.process.ctx); + } + if info.reply != 0 { + info.report_netlink(info.reply, &self.process.ctx); + } + Ok(()) } @@ -1332,6 +1340,7 @@ fn reply_inner(self: &Arc, info: &mut TransactionInfo) -> BinderResult { ); let reply = Err(BR_FAILED_REPLY); orig.from.deliver_reply(reply, &orig); + info.reply = BR_FAILED_REPLY; err.reply = BR_TRANSACTION_COMPLETE; err }); diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs index 47d5e4d88b07..ce1b1ccd080a 100644 --- a/drivers/android/binder/transaction.rs +++ b/drivers/android/binder/transaction.rs @@ -3,6 +3,7 @@ // Copyright (C) 2025 Google LLC. use kernel::{ + net::netlink::GENLMSG_DEFAULT_SIZE, prelude::*, seq_file::SeqFile, seq_print, @@ -17,6 +18,7 @@ allocation::{Allocation, TranslatedFds}, defs::*, error::{BinderError, BinderResult}, + netlink::Report, node::{Node, NodeRef}, process::{Process, ProcessInner}, ptr_align, @@ -49,6 +51,44 @@ impl TransactionInfo { pub(crate) fn is_oneway(&self) -> bool { self.flags & TF_ONE_WAY != 0 } + + pub(crate) fn report_netlink(&self, reply: u32, ctx: &crate::Context) { + if let Err(err) = self.report_netlink_inner(reply, ctx) { + pr_warn!( + "{}:{} netlink report failed: {err:?}\n", + self.from_pid, + self.from_tid + ); + } + } + + fn report_netlink_inner(&self, reply: u32, ctx: &crate::Context) -> kernel::error::Result { + if !Report::has_listeners() { + return Ok(()); + } + let mut report = Report::new(GENLMSG_DEFAULT_SIZE, 0, 0, GFP_KERNEL)?; + + report.error(reply)?; + report.context(&ctx.name)?; + report.from_pid(self.from_pid as u32)?; + report.from_tid(self.from_tid as u32)?; + if self.to_pid != 0 { + report.to_pid(self.to_pid as u32)?; + } + if self.to_tid != 0 { + report.to_tid(self.to_tid as u32)?; + } + + if self.is_reply { + report.is_reply()?; + } + report.flags(self.flags)?; + report.code(self.code)?; + report.data_size(self.data_size as u32)?; + + report.multicast(0, GFP_KERNEL)?; + Ok(()) + } } use core::mem::offset_of; diff --git a/rust/uapi/uapi_helper.h b/rust/uapi/uapi_helper.h index 06d7d1a2e8da..86c7b6b284b0 100644 --- a/rust/uapi/uapi_helper.h +++ b/rust/uapi/uapi_helper.h @@ -11,6 +11,7 @@ #include #include #include +#include #include #include #include -- 2.54.0.823.g6e5bcc1fc9-goog