linux-next.git/drivers/android/binder/node.rs, branch master

rust_binder: move (e)poll wait queue to Process

2026-07-17T13:21:01+00:00

Most processes do not use Rust Binder with epoll, so avoid paying the synchronize_rcu() cost in drop for those that don't need it. For those that do, we also manage to replace synchronize_rcu() with kfree_rcu(), though we introduce an extra allocation. In case the last ref to an Arc is dropped outside of deferred_release(), this also ensures that synchronize_rcu() is not called in destructor of Arc in other places. Theoretically that could lead to jank by making other syscalls slow, which would be problematic. Signed-off-by: Alice Ryhl Reviewed-by: Boqun Feng Link: https://patch.msgid.link/20260707-upgrade-poll-v6-2-4b8fae7bf1d9@google.com Signed-off-by: Greg Kroah-Hartman

rust_binder: Implement BINDER_DEBUG_DEAD_TRANSACTION

2026-07-17T13:15:22+00:00

This adds dynamic debug logs for: - Releasing active transactions during thread stack unwinding. - Discarded transaction error codes when a thread exits. - Undelivered transaction acknowledgments (TRANSACTION_COMPLETE) upon thread exit. - Undelivered process death and freeze notifications when processes exit or die. - Undelivered transactions canceled due to target process death. We now store the process PID in `ThreadError`, `DeliverCode`, and `FreezeMessage` to ensure the correct PID is logged on cancellation. This is necessary because `cancel()` runs from background `kworkers`, which would otherwise print the wrong PID. Reviewed-by: Alice Ryhl Reviewed-by: Carlos Llamas Signed-off-by: Jahnavi MN Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-7-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman

rust_binder: Implement BINDER_DEBUG_DEATH_NOTIFICATION

2026-07-17T13:15:21+00:00

This adds dynamic debug logs for: - Memory allocation (OOM) failures when requesting death notifications - Registration and cancellation lifecycle events (BC_REQUEST / BC_CLEAR) - Delivery of death notification events to userspace (BR_DEAD_BINDER) Reviewed-by: Carlos Llamas Reviewed-by: Alice Ryhl Signed-off-by: Jahnavi MN Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-6-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman

rust_binder: Implement BINDER_DEBUG_USER_ERROR for refcounting and death notifications

2026-07-17T13:15:21+00:00

This adds dynamic debug logs for: - Decrementing handle reference counts that are already zero. - Mismatched reference states (calling inc_ref_done with no active inc_refs, or using a weak reference as a strong reference). - Requesting or clearing death notifications on invalid references, already active notifications, or with mismatched cookies. Reviewed-by: Carlos Llamas Reviewed-by: Alice Ryhl Signed-off-by: Jahnavi MN Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-3-3d7436c2d2f2@google.com Signed-off-by: Greg Kroah-Hartman

Merge 7.2-rc3 into char-misc-next

2026-07-14T15:13:01+00:00

Resolves the merge conflicts in: drivers/android/binder/node.rs drivers/android/binder/process.rs As done by linux-next Reported-by: Mark Brown Signed-off-by: Greg Kroah-Hartman

rust_binder: avoid allocating under node_refs for freeze listeners

2026-07-10T14:57:56+00:00

The node_refs mutex needs to be changed to a spinlock, so in preparation for that, update freeze.rs to avoid allocating under the node_refs lock. This is done by adding a retry loop so that if add_freeze_listener() requires reallocating the KVVec<_> of freeze listeners, the caller will allocate a larger vector and retry. Analogously, the remove_freeze_listener() function is updated to return the empty KVVec<_> when it is no longer needed, to avoid calling kvfree() under the node_refs lock. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260615-binder-noderefs-spin-v3-1-3235f5a3e0a0@google.com Signed-off-by: Greg Kroah-Hartman

rust_binder: clear freeze listener on node removal

2026-07-03T11:54:10+00:00

Generally userspace is supposed to explicitly clear freeze listeners before they drop the refcount on the node ref to zero, but there's nothing forcing that. Currently, in this scenario the freeze listener remains in the freeze_listeners rbtree and in the remote node's freeze listener list, even though the ref for which the listener is registered is gone. This could potentially lead to a memory leak due to a refcount cycle. Thus, remove the freeze listener in this scenario. Cc: stable Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260703-remove-freeze-on-remove-node-v3-1-6e0c4547af46@google.com Signed-off-by: Greg Kroah-Hartman

rust: binder: enable `clippy::as_underscore`

2026-07-03T10:29:38+00:00

In Rust 1.63.0, Clippy introduced the `as_underscore` lint [1]: > The conversion might include lossy conversion or a dangerous cast that > might go undetected due to the type being inferred. > > The lint is allowed by default as using `_` is less wordy than always > specifying the type. Always specifying the type is especially helpful in function call contexts where the inferred type may change at a distance. Specifying the type also allows Clippy to spot more cases of `useless_conversion`. Several inferred conversions from `binder_uintptr_t` to the driver's internal `u64` node identifiers are identity conversions. Although the UAPI header retains `BINDER_IPC_32BIT` for userspace building against older kernels, commit 1190b4e38f97 ("ANDROID: binder: remove 32-bit binder interface.") removed kernel support for selecting that protocol. Rust Binder therefore uses the 64-bit Binder protocol on every supported architecture. While this does not eliminate unchecked `as` conversions, it makes such conversions easier to scrutinize. It also has the slight benefit of removing a degree of freedom on which to bikeshed. Thus apply the changes and enable the lint in the Binder Rust driver -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#as_underscore [1] Assisted-by: Codex:gpt-5 Signed-off-by: Tamir Duberstein Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260526-binder-strict-provenance-v2-4-a41d89c29bc5@kernel.org Signed-off-by: Greg Kroah-Hartman

rust: binder: enable `clippy::ref_as_ptr` lint

2026-07-03T10:29:38+00:00

In Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]: > Using `as` casts may result in silently changing mutability or type. While this does not eliminate unchecked `as` conversions, it makes such conversions easier to scrutinize. It also has the slight benefit of removing a degree of freedom on which to bikeshed. Thus apply the changes and enable the lint in the Binder Rust driver -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#ref_as_ptr [1] Assisted-by: Codex:gpt-5 Signed-off-by: Tamir Duberstein Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20260526-binder-strict-provenance-v2-3-a41d89c29bc5@kernel.org Signed-off-by: Greg Kroah-Hartman

rust: binder: use strict provenance APIs

2026-07-03T10:29:38+00:00

Replace the pointer-to-integer conversions in the Binder Rust driver with calls to the strict provenance APIs. The strict provenance APIs were stabilized in Rust 1.84.0 [1]. Since commit f32fb9c58a5b ("rust: bump Rust minimum supported version to 1.85.0 (Debian Trixie)"), the minimum supported Rust version is 1.85.0, so no polyfills are needed. Link: https://blog.rust-lang.org/2025/01/09/Rust-1.84.0.html#strict-provenance-apis [1] Reviewed-by: Alice Ryhl Assisted-by: Codex:gpt-5 Signed-off-by: Tamir Duberstein Reviewed-by: Gary Guo Link: https://patch.msgid.link/20260526-binder-strict-provenance-v2-1-a41d89c29bc5@kernel.org Signed-off-by: Greg Kroah-Hartman