From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04DEC3F9F48 for ; Tue, 9 Jun 2026 10:53:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781002398; cv=none; b=dvb80o24f8PwaAD79Bsco9TUUCvcYAT2DKsadFp6k0B2Jz0gWd0lKA//Ec6+VuJIa4tNMmb8OIY+RxZidQt31XaRnaIF3g3GjzlwdxUEDX2VAmoh0B/xAm10eSU0HxyRTcKwC4m7eRH4ALzC2l4fucMFefBcwfVrcupa47UGDus= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781002398; c=relaxed/simple; bh=z8/bjZsp3am85zxrUEQLRTItYorQtqnU2+9GLSyWZZE=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=ocq0vW0FsQ1GMErjzlWZzKd4rnz+UfdAxEO8gr5KaJdTKZOIJDpINeDoUc+ea4La62Ai55TLAba4wkkrsOdWSJAOBGk/6d+cSX/ek6NvAHmPgEcTOhM9lhV1tSDRmCthA/Hn8X9NV42YLLe1A4qQY2qhGdjOVltGYCnUzBcxxYA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=cgrpAIId; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="cgrpAIId" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-490ae461f8dso39758785e9.1 for ; Tue, 09 Jun 2026 03:53:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781002395; x=1781607195; darn=vger.kernel.org; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=QPFU6x+RKCIxPBY9TzbtGFpklCJgi8N62FETGtUCWJQ=; b=cgrpAIIdXcd9Y2VKUFXr8VVIy5yO2leSCVVpSwrDJIcV2DGaZOW373sOh7IJdUCYKZ peXMVsU8/luJOf9kIYIn/jk0M6uIbj9TCUeFZs9kOOYPN1c/DYoxECDX600NrI8iTvSa fE48sW8/DZynLp5RFX/QLP5LpWX70jptOg6/NnhQCLbAwsI+Z0J0WeBeENG+5AkVkA0e pHwj9vI39nar/swqx9HEPbOLMEjskbfnBZ7pSF57GqhwL7+7iuHaY8EuWBl4AQO5dVG0 Ij2B1sXXL2nLUjr+TgqahVkC+REHE57Z3uAddpb77DvotMAYK+SThY9RU15qrSifL1VR oZMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781002395; x=1781607195; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=QPFU6x+RKCIxPBY9TzbtGFpklCJgi8N62FETGtUCWJQ=; b=G9IEpbvxczwjRoMpS/Gpv+Qq4juefYMDoWt+MacqzRIouvr0cke+ieT+CU6Oyoj96l /qtM1BeZ8ug1KI/1WW7mGk8WGGXUERZIesXSX7BejXHZ3kimN4KQ7nrCXSc6F44ABNju /skYP7iMC8ZNU6ON3NVWO2y+9cbWL4aaNtJ11AexfMkAPw/coQgNYrbSlNmxz39FZCgy BHEdMx2QpEUntc/TtB3HBR8pAZr9VE41rR1M+tEu0hx4ynmJtTcHrYxmeZ8ng1TAPgvD S9vW8fMP9eVzIZ0RVtYd4YDyVQJFtQJyzVQb5Jem3UgJwvOIMagYDdxrd/XjK1fPOWYK jmlA== X-Forwarded-Encrypted: i=1; AFNElJ+WvlvLqupt8x2yVGBmTu6P/Nxu4d6v0kBsk3Z/1Vk+fBIwq9xLbPV9xxyZg8wshHCw4BzjlXHHMOxarb8=@vger.kernel.org X-Gm-Message-State: AOJu0Yz8OJXWHt91IYOBn9TFDBedA+4/prSbasX0QMaHIh+7K5Acdf4m IODktedNa8Yy0ENkgpxXDMaBXb+Hat7Z881Bp/tQmtF0QmKcXl2cy3+P4T/Tx7elUVO544XH+uG YMzt8cPr/vhoWyotb1w== X-Received: from wmbgv3.prod.google.com ([2002:a05:600c:80c3:b0:490:ad90:c234]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:3e83:b0:490:af90:f9c2 with SMTP id 5b1f17b1804b1-490c25b224dmr319816185e9.12.1781002395222; Tue, 09 Jun 2026 03:53:15 -0700 (PDT) Date: Tue, 09 Jun 2026 10:53:03 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAI7wJ2oC/02Nyw6CMBQFf4XctdeUh+XxK4YFlFPtghZbJEbCv 9uAJi5nFjMrBXiDQE2yksdignE2QnpKSN07ewObITJlIpNCipo9RreAtQfeYGd/wroBnAuUmda yLyQoJiYPbV57/toe7PF4xst8SOq7AFZuHM3cJEt5TtkrSf/35ruuuDd2gN9PsRs4TMZy3gkoc alqUeTNklG7bR/vuWnd1QAAAA== X-Change-Id: 20260609-remove-freeze-on-remove-node-30e72ff6b46e X-Developer-Key: i=aliceryhl@google.com; a=openpgp; fpr=49F6C1FAA74960F43A5B86A1EE7A392FDE96209F X-Developer-Signature: v=1; a=openpgp-sha256; l=5429; i=aliceryhl@google.com; h=from:subject:message-id; bh=z8/bjZsp3am85zxrUEQLRTItYorQtqnU2+9GLSyWZZE=; b=owEBbQKS/ZANAwAKAQRYvu5YxjlGAcsmYgBqJ/CVAmZoDnNNbp9NJ3e4+K8fwkBtEpzbyvdWc MZ9RCCtkW2JAjMEAAEKAB0WIQSDkqKUTWQHCvFIvbIEWL7uWMY5RgUCaifwlQAKCRAEWL7uWMY5 RpdtD/46XB+90vkSBbCyQNJL9JF7qujkTCaCNzUmrjOSc+XAunFZ06tUZ1n3cZaixhKNTjD7sxu gEO7STLx7O+znwTgXKj+KjdLVYp2largjG0vsmIGRH6Mg+Ow+Iv3io5Bc2i6FHs8yhAKIKh2H9L ibXQGjqc3xaoeHQ8t1LxH1Z36w3R03lXVJi1hGz9Qiqb/PtoJmRiy3lH2vbS94hKBfwJYWOZLSo vZ5Odu+SobNSwc7cep+2AfgVfosLKoVrlOE8qjIjLDxUJfxbl4a55YWnBG7yyDU+cngAi2gRMA6 FVps8PRh7LWHXsoAu4dUcjHec/XGuoyp0vtIfz+MyrydXACf14whmdE7vH48+3fgOrX45vTDGnn b3bD3OlS3FpG+A1BfHh+Xj2i2OyqJPwYqHhbrWHGaX1nk9zCFQ2JbvtKxqi5sUGLR16nfCNcN/A qzFfCBmplD+mbnKYtP8uVPV0aqBZdfbLuAFnhVPE3YZPZfVCoS5jVOR+qPidpc+2jyBrXVMwmud 0DRCpXJKXLIrBYI2yoWeybpV4q0LdzDChUmR3OIEViXaAGeJ67vPBeAH3eCMGMTLF4JmZwOLKbS eJy0ysvwm7he/ufLK7VKI+glXVMS0clSZ8zcrthPzf3HLWX8l40ayhdLhwBSwL1GT0QFUzeNEBd KCYWZ5aTKfzPEPg== X-Mailer: b4 0.14.3 Message-ID: <20260609-remove-freeze-on-remove-node-v1-1-f67f3b9bfeb8@google.com> Subject: [PATCH] rust_binder: clear freeze listener on node removal From: Alice Ryhl To: Greg Kroah-Hartman , Carlos Llamas Cc: Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?q?Bj=C3=B6rn_Roy_Baron?=" , Benno Lossin , Andreas Hindborg , Alice Ryhl , Trevor Gross , Danilo Krummrich , rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Content-Type: text/plain; charset="utf-8" Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Alice Ryhl --- This series is based on top of: https://lore.kernel.org/all/20260609-binder-noderefs-spin-v2-0-eafde2ff376c@google.com/ --- drivers/android/binder/freeze.rs | 11 +++++++++-- drivers/android/binder/node.rs | 6 ++++-- drivers/android/binder/process.rs | 13 +++++++++++-- 3 files changed, 24 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs index 20041689e98d..1b49e63723b5 100644 --- a/drivers/android/binder/freeze.rs +++ b/drivers/android/binder/freeze.rs @@ -154,10 +154,17 @@ fn debug_print(&self, m: &SeqFile, prefix: &str, _tprefix: &str) -> Result<()> { } impl FreezeListener { - pub(crate) fn on_process_exit(&self, proc: &Arc) { + /// Called when this freeze listener is cleared abnormally. + /// + /// This occurs either because the process exited or because the process dropped its last + /// refcount on the node ref without explicitly removing the freeze listener first. + /// + /// The returned `KVVec` is just a value that should be dropped outside of the lock. + pub(crate) fn on_process_cleanup(&self, proc: &Process) -> KVVec> { if !self.is_clearing { - self.node.remove_freeze_listener(proc); + return self.node.remove_freeze_listener(proc); } + KVVec::new() } } diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs index fb27674a8c94..79f660071bd6 100644 --- a/drivers/android/binder/node.rs +++ b/drivers/android/binder/node.rs @@ -687,11 +687,13 @@ pub(crate) fn resize_for_add_freeze_listener( Ok(()) } - pub(crate) fn remove_freeze_listener(&self, p: &Arc) -> KVVec> { + pub(crate) fn remove_freeze_listener(&self, p: &Process) -> KVVec> { let mut guard = self.owner.inner.lock(); let inner = self.inner.access_mut(&mut guard); let len = inner.freeze_list.len(); - inner.freeze_list.retain(|proc| !Arc::ptr_eq(proc, p)); + inner + .freeze_list + .retain(|proc| !core::ptr::eq::(&**proc, p)); if len == inner.freeze_list.len() { pr_warn!( "Could not remove freeze listener for {}\n", diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs index 82c34a93660e..5802fbbaacd3 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -950,6 +950,8 @@ pub(crate) fn update_ref( // increment references on itself. let _to_free_by_handle; let _to_free_by_node; + let _to_free_freeze_listener; + let _to_free_freeze_listener_cleanup; let mut refs = self.node_refs.lock(); if let Some(info) = refs.by_handle.get_mut(&handle) { if info.node_ref().update(inc, strong) { @@ -965,8 +967,15 @@ pub(crate) fn update_ref( // SAFETY: We are removing the `NodeRefInfo` from the right node. unsafe { info.node_ref2().node.remove_node_info(info) }; - let id = info.node_ref().node.global_id(); + + if let Some(freeze) = *info.freeze() { + if let Some(fl) = refs.freeze_listeners.remove(&freeze) { + _to_free_freeze_listener_cleanup = fl.on_process_cleanup(&self); + _to_free_freeze_listener = fl; + } + } + _to_free_by_handle = refs.by_handle.remove_node(&handle); _to_free_by_node = refs.by_node.remove_node(&id); refs.handle_is_present.release_id(handle as usize); @@ -1391,7 +1400,7 @@ fn deferred_release(self: Arc) { // Clean up freeze listeners. let freeze_listeners = take(&mut self.node_refs.lock().freeze_listeners); for listener in freeze_listeners.values() { - listener.on_process_exit(&self); + listener.on_process_cleanup(&self); } drop(freeze_listeners); --- base-commit: 3bc831df9ee16fceee851872315161377ca1417d change-id: 20260609-remove-freeze-on-remove-node-30e72ff6b46e prerequisite-change-id:20260608-binder-noderefs-spin-3a0ec0589043:v2 prerequisite-patch-id: 3a1c4f545b2281e2e91ea0af7fe6c71f5ae0c08e prerequisite-patch-id: e1ae5f73b329080c0fcea1d2509c085e105f67c3 prerequisite-patch-id: 63f2092c6fd9dd54b7adf93be8d5670d8490f401 prerequisite-patch-id: 5811aeb4ca435a1d4d0bb347d4de9f3b2d91f814 prerequisite-patch-id: 556e45c697f9888c8446245bbcf478422991fddf prerequisite-patch-id: f567ba2263108b12871013309ae7c482d500eeae Best regards, -- Alice Ryhl