From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92829305698 for ; Wed, 7 Oct 2026 00:51:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791334271; cv=none; b=RwIQcMhF2FeV5iIKiP2XHJPO7h7xD/0untN4bN9wZ+76kwo7HPAVWHp+TMwOVnaZqSFOW8pWapEWKIjTKi2/GfT+5tepnpU7Uyf5nsRZQ5lwolg9DSZlyB0XQkLNzjDGMLCp2soTKdEBL0RBVirE6KYBSi/YC7kI62/M99owma8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791334271; c=relaxed/simple; bh=kupnXAqBCeGqkSWGxY93Jtt2gRH2yMcX2wu8exSPCag=; h=Date:To:From:Subject:Message-Id; b=ttU0gqeh3RiRwDyhkhJi0i5j7ppJ3egPa7I/7VhiPEOsIhhBT08CL7gZwrQPGfN+R0EEGUZbbadLSS9bvuf8bChPGij8IuRklvP/WabsHVnLFX4Im/YKF6SOGjUGBrny4z6A5bhXW9mdca/mbe4yHCdQ+NL87GSQ8QOFz8jSci8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=d5EVeB/+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="d5EVeB/+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 665741F0089B; Wed, 7 Oct 2026 00:51:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1791334269; bh=9k83ebqUF7nGkJATocYPVmtaJG0AhVCl6DrimNn8wTw=; h=Date:To:From:Subject; b=d5EVeB/+fFCZpVPToUxbO8C6LTUaEsSETglM4DIKb/ORSGskVgDLBIsZni/V8Sf+G tsvMN4wVwkZvcCohxlqOi4XTmHxyO3ZeH35HGs0SkkBJwoisk6/SN3w7a2Ip16McQ+ U5TVlubIbK3yRBo6IW8TmgOBjyPUBJhnzLLN+Oac= Date: Tue, 06 Oct 2026 17:51:09 -0700 To: mm-commits@vger.kernel.org,vbabka@kernel.org,tkjos@android.com,surenb@google.com,shakeel.butt@linux.dev,ljs@kernel.org,liam@infradead.org,gregkh@linuxfoundation.org,dsahern@kernel.org,david@kernel.org,davem@davemloft.net,cmllamas@google.com,christian@brauner.io,arve@android.com,aliceryhl@google.com,dave.hansen@linux.intel.com,akpm@linux-foundation.org From: Andrew Morton Subject: [merged mm-stable] binder-remove-mmap_lock-fallback.patch removed from -mm tree Message-Id: <20261007005109.665741F0089B@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The quilt patch titled Subject: binder: remove mmap_lock fallback has been removed from the -mm tree. Its filename was binder-remove-mmap_lock-fallback.patch This patch was dropped because it was merged into the mm-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Dave Hansen Subject: binder: remove mmap_lock fallback Date: Mon, 31 Aug 2026 13:30:55 -0700 Previously, the per-VMA locking could fail in the face of writers which necessitate a fallback to mmap_lock. The new vma_start_read_unlocked() will wait for writers instead of failing. Use the new helper. Wait for writers. Remove the fallback to mmap_lock. Link: https://lore.kernel.org/20260831203056.838265-5-surenb@google.com Signed-off-by: Dave Hansen Signed-off-by: Suren Baghdasaryan Signed-off-by: Andrew Morton Reviewed-by: Alice Ryhl Acked-by: Lorenzo Stoakes (ARM) Cc: Liam R. Howlett Cc: Vlastimil Babka Cc: Shakeel Butt Cc: Greg Kroah-Hartman Cc: Todd Kjos Cc: Christian Brauner Cc: Carlos Llamas Cc: David S. Miller Cc: David Ahern Cc: Arve Hjønnevåg Cc: David Hildenbrand (Arm) --- drivers/android/binder/page_range.rs | 19 ++-------------- drivers/android/binder_alloc.c | 17 ++++----------- rust/kernel/mm.rs | 28 +++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 28 deletions(-) --- a/drivers/android/binder_alloc.c~binder-remove-mmap_lock-fallback +++ a/drivers/android/binder_alloc.c @@ -259,21 +259,14 @@ static int binder_page_insert(struct bin struct vm_area_struct *vma; int ret = -ESRCH; - /* attempt per-vma lock first */ - vma = lock_vma_under_rcu(mm, addr); - if (vma) { - if (binder_alloc_is_mapped(alloc)) - ret = vm_insert_page(vma, addr, page); - vma_end_read(vma); + vma = vma_start_read_unlocked(mm, addr); + if (!vma) return ret; - } - /* fall back to mmap_lock */ - mmap_read_lock(mm); - vma = vma_lookup(mm, addr); - if (vma && binder_alloc_is_mapped(alloc)) + if (binder_alloc_is_mapped(alloc)) ret = vm_insert_page(vma, addr, page); - mmap_read_unlock(mm); + + vma_end_read(vma); return ret; } --- a/drivers/android/binder/page_range.rs~binder-remove-mmap_lock-fallback +++ a/drivers/android/binder/page_range.rs @@ -439,22 +439,9 @@ impl ShrinkablePageRange { // workqueue. let mm = MmWithUser::into_mmput_async(self.mm.mmget_not_zero().ok_or(ESRCH)?); { - let vma_read; - let mmap_read; - let vma = if let Some(ret) = mm.lock_vma_under_rcu(vma_addr) { - vma_read = ret; - check_vma(&vma_read, self) - } else { - mmap_read = mm.mmap_read_lock(); - mmap_read - .vma_lookup(vma_addr) - .and_then(|vma| check_vma(vma, self)) - }; - - match vma { - Some(vma) => vma.vm_insert_page(user_page_addr, &new_page)?, - None => return Err(ESRCH), - } + let vma_read_guard = mm.vma_start_read_unlocked(vma_addr).ok_or(ESRCH)?; + let vma = check_vma(&vma_read_guard, self).ok_or(ESRCH)?; + vma.vm_insert_page(user_page_addr, &new_page)?; } let inner = self.lock.lock(); --- a/rust/kernel/mm.rs~binder-remove-mmap_lock-fallback +++ a/rust/kernel/mm.rs @@ -186,6 +186,34 @@ impl MmWithUser { }) } + /// Find the VMA covering 'address' and read-lock it. + /// + /// The fast path does not take mmap_lock. Waits for writers to finish if the + /// VMA is being modified by taking mmap_lock. + /// Use when mmap_lock is not held, otherwise use vma_start_read_locked(). + /// Nothing prevents VMAs being unmapped/mapped before or after the VMA is + /// looked up, if a stronger guarantee is required, take an mmap_lock. + /// + /// Return: If a VMA exists which spans @address, return that VMA, read-locked. + /// If no VMA is mapped there or, very unlikely, a reference count overflow + /// occurred, return NULL. + #[inline] + pub fn vma_start_read_unlocked(&self, vma_addr: usize) -> Option> { + // SAFETY: We may invoke `vma_start_read_unlocked` because we know this `mm` has non-zero + // `mm_users`. + let vma = unsafe { bindings::vma_start_read_unlocked(self.as_raw(), vma_addr) }; + if vma.is_null() { + return None; + } + // INVARIANT: We just acquired the VMA read lock. + Some(VmaReadGuard { + // SAFETY: If `vma_start_read_unlocked` returns a non-null ptr, then it points at a + // valid vma. The vma is stable for as long as the vma read lock is held. + vma: unsafe { VmaRef::from_raw(vma) }, + _nts: NotThreadSafe, + }) + } + /// Lock the mmap read lock. #[inline] pub fn mmap_read_lock(&self) -> MmapReadGuard<'_> { _ Patches currently in -mm which might be from dave.hansen@linux.intel.com are