The destructor of AllocationInfo could potentially sleep. Don't call it
from reservation_commit.
Reported-by: Gary Guo <gary@garyguo.net>
Fixes: dac7c66bc9 ("ANDROID: rust_binder: move Rust Binder in preparation for GKI module")
Change-Id: Iea4d675c7b9db51019739c0b462b9108f7fecf0b
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Rust Binder cleanup is reworked to match the order in which C Binder
cleans up things. A few notes on the changes:
* Actually dropping thread objects is done at the very end because they
contain a call to synchronize_rcu() which is slow. This ensures that
death notifications are sent without waiting for those calls. This
avoids failures in rustBinderTest. (The test is already flaky, but
this extra sleep makes the flake much more likely to happen.)
* We now free refs on remote nodes in release explicitly. Previously
that only happened implicitly when everything keeping the ref alive
has been dropped. To avoid spurious warnings from this, the warning
print about dropping a ref that doesn't exist is only printed if the
process is alive.
Bug: 431914626
Change-Id: I3d1f4f15ffac7587d1bb0113a41330b2aea69b3d
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
This fixes some test failures in rustBinderTest caused by commit
f06dd0cd35 ("ANDROID: rust_binder: release threads before refs").
Honestly I'm not entirely sure why. Note that this reverses that commit,
and fixes the resulting logspam by instead moving cleanup of allocated
buffers to the end of process release.
Bug: 431914626
Change-Id: I1f7faa486f86cef7fbe37ad87b720573a5e05ee5
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Rust Binder currently returns an error when death notifications are
registered or removed illegally. This causes tests that use the kernel
interface incorrectly to fail. To have the same behavior as C Binder,
adjust the death notification logic to print but otherwise ignore these
error conditions.
Bug: 430659969
Change-Id: Ia11aebea74ae1441fc48e40cbf43fae56bf3be54
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The C Binder driver uses binder_uintptr_t for the cookie, which always
corresponds to a 64-bit integer.
Bug: 430659969
Change-Id: I6a83d0959fa97f994fb3180351329a4bf843110d
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Commit 5da94eacba ("ANDROID: rust_binder: print and avoid underflow
with invalid refcnt") added a print when decrementing the refcount if
the ref doesn't exist. This revealed that this sometimes happens inside
thread.release() because the refs were cleared before releasing the
threads. In principle this error is harmless, but to avoid printing this
error, release threads before clearing refs.
Bug: 430660253
Change-Id: I9ceb71ca831f5bb58193e12951245bab19ea4fa2
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
We landed the MM series as FROMLIST, and in the version of the series
that landed upstream the VmAreaNew type had been renamed to VmaNew.
Thus, update the naming in Rust Binder.
Bug: 429146594
Change-Id: I244decf4fa7e0ee9077a5f1a2a82f409eccde290
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Because we are backporting commit e0020ba6cbcb ("rust: add
PidNamespace"), it is neccesary to update Rust Binder to use the new
tgid_nr_ns() method for getting the task's pid, as that commit deleted
pid_in_current_ns().
Bug: 429146594
Change-Id: I3acd7e3f1fee2957d5663208614667220e09dfd5
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Currently the binder_logs/procs/pid file is removed in the deferred
release callback that runs on the workqueue, which means that it may run
after the underlying filesystem is unmounted. However, dentries must be
removed before the filesystem goes away, so remove it explicitly when
scheduling the deferred release callback.
Bug: 426116428
Change-Id: I77db9261711989f8d4cd4c3a22903ff83a3fa9b7
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Userspace may send invalid refcount changes that correspond to handles
that do not exist, or are otherwise invalid decrements. (For example, a
weak decrement on a node that only has strong refs.) When such invalid
usage of the userspace API happens, just print and do not change the
refcnt.
This fixes a crash on underflow when computing `0-1` with an unsigned
integer.
Bug: 426101719
Reported-and-tested-by: syzbot+983b7a2aeabc09449c43@syzkaller.appspotmail.com
Fixes: dac7c66bc9 ("ANDROID: rust_binder: move Rust Binder in preparation for GKI module")
Change-Id: I987a5dd3a4b028c0dc843fc3b3a4e0087a46fd37
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Rust Binder currently makes a nullptr deref when the poll_table passed
to f_ops->poll is a null pointer. This is due to the incorrect
assumption that this pointer is never null. To fix this, I adjusted the
API of the Rust PollTable to allow turning null ptrs into a Rust
PollTable and adjusted Rust Binder to use the updated API. By also
adjusting the PollTable api itself, and not just Rust Binder, this kind
of mistake should be prevented in the future.
Bug: 426545861
Change-Id: I1eabd62d5e499c83b990517c93a63d7de49252ab
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The ioctl GET_NODE_INFO_FOR_REF will query the refcount of a remote
node, which servicemanager uses to determine whether a lazy service
should be shut down. To return the right counts, the ioctl itself should
not take a refcount on the node.
Bug: 427655909
Change-Id: I79a5e9f9506e6437900c8188de950ee449f8ec89
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Since Node uses a LockedBy<ProcessInner> for its protected data, we need
a `&mut ProcessInner` to access the node. However, if we are iterating
over the `process.nodes` rbtree, then we cannot give out exclusive
access to all of `process, as the `nodes` field is in use. To handle
this, we temporarily move the `nodes` field to a local variable (during
which `process.nodes` must not be accessed) and iterate over the local
variable instead.
Add an abstraction to make the above easier, and remove the possibility
of forgetting to put the `nodes` field back into `process` when
releasing the lock.
Bug: 423900220
Change-Id: I50139b422f6973afea4a23c496b04ffc70a956ca
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The binder driver implements freeze notifications so that it can wait
for processes to thaw.
A quick overview of the protocol: Everything starts when a process
requests freeze notifications by using BC_REQUEST_FREEZE_NOTIFICATION
with a node that it has a handle to. When making this call, the process
must pass a cookie that uniquely identifies the freeze notification in
the local process (usually this is a pointer into its own address
space).
Upon creation of the freeze listener, and upon each change to the freeze
state, a BR_FROZEN_BINDER message containing the current state is
delivered. Whenever a BR_FROZEN_BINDER message is delivered, the driver
guarantees that no further messages are sent in relation to that freeze
listener until the driver responds with BC_FREEZE_NOTIFICATION_DONE.
The BC_CLEAR_FREEZE_NOTIFICATION command can be used to remove an
existing freeze listener. Once it's guaranteed that the kernel will no
longer send anything for the listener, BR_CLEAR_FREEZE_NOTIFICATION_DONE
is sent. Note that BR_CLEAR_FREEZE_NOTIFICATION_DONE is never sent
between BR_FROZEN_BINDER and BC_FREEZE_NOTIFICATION_DONE messages, so if
the kernel just delivered BR_FROZEN_BINDER, it will not reply with
BR_CLEAR_FREEZE_NOTIFICATION_DONE until BC_FREEZE_NOTIFICATION_DONE is
received.
The implementation uses a FreezeMessage type which will deliver either
BR_FROZEN_BINDER or BR_CLEAR_FREEZE_NOTIFICATION_DONE depending on the
state, or it may do nothing if no action is needed. One assumption of
this implementation is that it's always okay to have too many pending
FreezeMessages in flight. This allows us to send a FreezeMessage at any
time without checking whether one is already in flight.
Bug: 423900220
Change-Id: Iabb589d2b311d9d9a5907ad9187824a10edb7415
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
The 6.12.19 LTS of the kernel contains some changes to the Rust kernel
crate involving the integer types used for FFI and the removal of the
alloc crate in favor of a custom alloc utilities.
Bug: 388786466
Change-Id: Ie4cab650deaf1f2ffc4ee64d367e52f0671791c1
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Tracepoints were removed from the the vendor module version of Rust
Binder as it required either fixing b/394605825 or hard-coding the
tracepoint declarations as created by bindgen.
As we are moving Rust Binder back into common/, this no longer depends
on invoking bindgen from the DDK. Thus, revert these changes.
Bug: 394605825
Bug: 388786466
Change-Id: I81fe5b2b4c92826c6478606cd78c8fccd8a5c7e4
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
This moves the code from the common-modules/binder branch verbatim. The
code is not yet added to the build system as it requires some adjusments
before it can built as a GKI module.
Bug: 388786466
Change-Id: I6b49b1b6ff0e35fbae2b9efc13d6bbde984b5196
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Alice Ryhl