From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5C0FC433DF for ; Thu, 20 Aug 2020 07:52:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A028621744 for ; Thu, 20 Aug 2020 07:52:03 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=android.com header.i=@android.com header.b="vVTaDo2U" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726957AbgHTHwB (ORCPT ); Thu, 20 Aug 2020 03:52:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41820 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725819AbgHTHv5 (ORCPT ); Thu, 20 Aug 2020 03:51:57 -0400 Received: from mail-ej1-x644.google.com (mail-ej1-x644.google.com [IPv6:2a00:1450:4864:20::644]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10A01C061757 for ; Thu, 20 Aug 2020 00:51:57 -0700 (PDT) Received: by mail-ej1-x644.google.com with SMTP id o23so1413154ejr.1 for ; Thu, 20 Aug 2020 00:51:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=android.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=3iJ9/fK5LB+6Kor9RoXGNOLvcbD9Ssuir1D7JZUYEZQ=; b=vVTaDo2Ur+t1k5v/hjwxfcOoDSC6nxBbJPQAWOfhKxMOXA13Ayg65BQ4cdgIk57V4m /H/zi0NyhUDS1+NL1r4L5tZdYybjr92n6LYfYS2CMej9pejnQoVFBJUczJ4zGric3avP Y+2aGEJyGAYfvJvqi5EpCv/GwFeWzIgOTysDc9/D64nI/+rl1A6PJDkFacCqxlEs4ovt W+tWkO72YgBOFwtQsIKMv98InuTzozuS9IENFuPIrOkO78YL7YygajKZN9i6i35MsBhN YPGLtTSRax2pKNqruLk9xslwMvIe6YSR1gs/3sbg4fWiYMBQFTLyMJCO8kt7WTSfRiIq pz5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=3iJ9/fK5LB+6Kor9RoXGNOLvcbD9Ssuir1D7JZUYEZQ=; b=ZdBxtTmPElFIIXrPm6XWYRN07aoPC26t/EpGPIytzi9Gwc/kcSexJZ1APAxjHQjOkn HrWAxZ4oQaWihaDHqHMCWiyB++br9R/2W82Q7dvolyJ9Y3UtCdQnmKXtFP2y3NZtLlml NR3JnJCJiHFpv9zxhTh/z+fjpRECHo0bGYLepV135lQ6auF5FoYefSwsIKhHJsZzmOid Fx7O8bzR68zALICukeD/dmyqJvsgESQtMWGYwF2U/WFwVFfFD3mnLZm2n7jSeojSQea2 cI4Ixc39vjXZeva7x+701IbJX9IY+DCLDKANvvcuEvpdSJjxpyPxVepdIqhTIoP/DPsl FCdg== X-Gm-Message-State: AOAM533mDqay3+EZt0ihwqCg6ISJmpy/RS3iFhuQpOECz1TwgTt6jIZk BCfO7mFH0ZoO8oTJMVJS0alj/A== X-Google-Smtp-Source: ABdhPJyl6aVYd1dRYJ+2QTDFpYpAk07k8IYLGLewCo+zey/nRl010HIldBrnD28vF0nrOD3pIDDQBQ== X-Received: by 2002:a17:906:a3d5:: with SMTP id ca21mr1971315ejb.453.1597909915660; Thu, 20 Aug 2020 00:51:55 -0700 (PDT) Received: from maco2.ams.corp.google.com (a83-162-234-235.adsl.xs4all.nl. [83.162.234.235]) by smtp.gmail.com with ESMTPSA id p1sm836281edu.11.2020.08.20.00.51.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2020 00:51:55 -0700 (PDT) From: Martijn Coenen To: gregkh@linuxfoundation.org, tkjos@google.com, arve@android.com, joel@joelfernandes.org, christian@brauner.io, hridya@google.com, surenb@google.com Cc: linux-kernel@vger.kernel.org, devel@driverdev.osuosl.org, maco@google.com, Martijn Coenen Subject: [PATCH] binder: print warnings when detecting oneway spamming. Date: Thu, 20 Aug 2020 09:51:33 +0200 Message-Id: <20200820075133.87040-1-maco@android.com> X-Mailer: git-send-email 2.28.0.220.ged08abb693-goog MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The most common cause of the binder transaction buffer filling up is a client rapidly firing oneway transactions into a process, before it has a chance to handle them. Yet the root cause of this is often hard to debug, because either the system or the app will stop, and by that time binder debug information we dump in bugreports is no longer relevant. This change warns as soon as a process dips below 80% of its oneway space (less than 100kB available in the configuration), when any one process is responsible for either more than 50 transactions, or more than 50% of the oneway space. Signed-off-by: Martijn Coenen --- drivers/android/binder.c | 2 +- drivers/android/binder_alloc.c | 49 +++++++++++++++++++++++++++++++--- drivers/android/binder_alloc.h | 5 +++- 3 files changed, 51 insertions(+), 5 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index f936530a19b0..946332bc871a 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3136,7 +3136,7 @@ static void binder_transaction(struct binder_proc *proc, t->buffer = binder_alloc_new_buf(&target_proc->alloc, tr->data_size, tr->offsets_size, extra_buffers_size, - !reply && (t->flags & TF_ONE_WAY)); + !reply && (t->flags & TF_ONE_WAY), current->tgid); if (IS_ERR(t->buffer)) { /* * -ESRCH indicates VMA cleared. The target is dying. diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c index 69609696a843..76e8e633dbd4 100644 --- a/drivers/android/binder_alloc.c +++ b/drivers/android/binder_alloc.c @@ -338,12 +338,48 @@ static inline struct vm_area_struct *binder_alloc_get_vma( return vma; } +static void debug_low_async_space_locked(struct binder_alloc *alloc, int pid) +{ + /* + * Find the amount and size of buffers allocated by the current caller; + * The idea is that once we cross the threshold, whoever is responsible + * for the low async space is likely to try to send another async txn, + * and at some point we'll catch them in the act. This is more efficient + * than keeping a map per pid. + */ + struct rb_node *n = alloc->free_buffers.rb_node; + struct binder_buffer *buffer; + size_t buffer_size; + size_t total_alloc_size = 0; + size_t num_buffers = 0; + + for (n = rb_first(&alloc->allocated_buffers); n != NULL; + n = rb_next(n)) { + buffer = rb_entry(n, struct binder_buffer, rb_node); + if (buffer->pid != pid) + continue; + if (!buffer->async_transaction) + continue; + buffer_size = binder_alloc_buffer_size(alloc, buffer); + total_alloc_size += buffer_size; + num_buffers++; + } + + // Warn if this pid has more than 50% of async space, or more than 50 txns + if (num_buffers > 50 || total_alloc_size > alloc->buffer_size / 4) { + binder_alloc_debug(BINDER_DEBUG_USER_ERROR, + "%d: pid %d spamming oneway? %zd buffers allocated for a total size of %zd\n", + alloc->pid, pid, num_buffers, total_alloc_size); + } +} + static struct binder_buffer *binder_alloc_new_buf_locked( struct binder_alloc *alloc, size_t data_size, size_t offsets_size, size_t extra_buffers_size, - int is_async) + int is_async, + int pid) { struct rb_node *n = alloc->free_buffers.rb_node; struct binder_buffer *buffer; @@ -486,11 +522,16 @@ static struct binder_buffer *binder_alloc_new_buf_locked( buffer->offsets_size = offsets_size; buffer->async_transaction = is_async; buffer->extra_buffers_size = extra_buffers_size; + buffer->pid = pid; if (is_async) { alloc->free_async_space -= size + sizeof(struct binder_buffer); binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC, "%d: binder_alloc_buf size %zd async free %zd\n", alloc->pid, size, alloc->free_async_space); + if (alloc->free_async_space < alloc->buffer_size / 10) { + // Start detecting spammers once we reach 80% of async space used + debug_low_async_space_locked(alloc, pid); + } } return buffer; @@ -508,6 +549,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( * @offsets_size: user specified buffer offset * @extra_buffers_size: size of extra space for meta-data (eg, security context) * @is_async: buffer for async transaction + * @pid: pid to attribute allocation to (used for debugging) * * Allocate a new buffer given the requested sizes. Returns * the kernel version of the buffer pointer. The size allocated @@ -520,13 +562,14 @@ struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, size_t data_size, size_t offsets_size, size_t extra_buffers_size, - int is_async) + int is_async, + int pid) { struct binder_buffer *buffer; mutex_lock(&alloc->mutex); buffer = binder_alloc_new_buf_locked(alloc, data_size, offsets_size, - extra_buffers_size, is_async); + extra_buffers_size, is_async, pid); mutex_unlock(&alloc->mutex); return buffer; } diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h index db9c1b984695..55d8b4106766 100644 --- a/drivers/android/binder_alloc.h +++ b/drivers/android/binder_alloc.h @@ -32,6 +32,7 @@ struct binder_transaction; * @offsets_size: size of array of offsets * @extra_buffers_size: size of space for other objects (like sg lists) * @user_data: user pointer to base of buffer space + * @pid: pid to attribute the buffer to (caller) * * Bookkeeping structure for binder transaction buffers */ @@ -51,6 +52,7 @@ struct binder_buffer { size_t offsets_size; size_t extra_buffers_size; void __user *user_data; + int pid; }; /** @@ -117,7 +119,8 @@ extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, size_t data_size, size_t offsets_size, size_t extra_buffers_size, - int is_async); + int is_async, + int pid); extern void binder_alloc_init(struct binder_alloc *alloc); extern int binder_alloc_shrinker_init(void); extern void binder_alloc_vma_close(struct binder_alloc *alloc); -- 2.28.0.220.ged08abb693-goog