* [PATCH v3 0/7] rust_binder : Implement dynamic debug logging mask
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
When a user-space application sends malformed data or makes a
lifecycle mistake, the driver rejects it with a generic error code
(like -EINVAL). Without internal logs, the driver acts as a
"black box," forcing developers to guess which check failed.
In the legacy C Binder driver, this issue is solved using a dynamic
debug_mask module parameter that toggles verbose logs for specific
subsystems. This series brings the same critical capability to the
Rust Binder driver to provide developers with clear, real-time
feedback.
Instead of rebuilds, reboots, or guessing:
- Developers can enable logs instantly on a running device by writing to
`/sys/module/rust_binder/parameters/debug_mask`.
- It prints the exact reason for failures (such as alignment errors,
mismatched call stacks, or invalid handle references) directly into
`dmesg`, reducing debugging time from hours to seconds.
- It protects system logs by keeping logging off by default and only
enabling it when developers are actively troubleshooting.
Based on top of:
https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
Changes in v3:
- Rebase the entire series on top of the latest char-misc-testing tree.
- Define `rust_binder_debug_mask` in Rust as an `Atomic<u32>` and export it to
C as `extern u32` to avoid raw volatile reads and FFI UB.
- Use `kernel::bits::bit_u32` instead of raw bit shifts.
- Simplify `binder_debug!` macro rules and remove the redundant `raw` helper.
- Wrap the raw mask in `DebugMasks` to use type-safe `.contains(mask)`.
- Link to v2: https://lore.kernel.org/r/20260710-rust_binder_debug_mask-v2-0-2846410e3ae6@google.com
Changes in v2:
- Defined the debug mask categories using bitflags (impl_flags) to
resolve potential Undefined Behavior and match Rust idioms.
- Added a tgid helper to rust/kernel/task.rs to expose the task
group ID and optimize default "PID:TID" prefixing.
- Implemented the BINDER_DEBUG_DEATH_NOTIFICATION mask to log OOM
failures, lifecycle updates, and async delivery to user-space.
- Added pid fields to ThreadError, DeliverCode, and FreezeMessage
to ensure cancellation logs show the correct process PID instead
of background kworker PIDs.
- Removed duplicate PID printing across workqueue, transaction
failure, and stack unwinding logs.
- Refactored log formatting (e.g. formatted BinderError with {:?},
used "strong"/"weak" strings, and improved message wording).
- Fixed logic bugs (restored missing update_ref block, moved manager
lookup warnings).
- Cleaned up spurious newlines, corrected indentations, and adjusted
all commit titles to be shorter and more meaningful.
- Link to v1: https://lore.kernel.org/r/20260703-rust_binder_debug_mask-v1-0-9bdf12b5325c@google.com
---
Jahnavi MN (7):
rust_binder: Add dynamic debug logging mask
rust_binder: Implement BINDER_DEBUG_USER_ERROR for freezer-related operation
rust_binder: Implement BINDER_DEBUG_USER_ERROR for refcounting and death notifications
rust_binder: Implement BINDER_DEBUG_USER_ERROR for transaction parsing failures
rust_binder: Implement BINDER_DEBUG_FAILED_TRANSACTION
rust_binder: Implement BINDER_DEBUG_DEATH_NOTIFICATION
rust_binder: Implement BINDER_DEBUG_DEAD_TRANSACTION
drivers/android/binder/debug.rs | 76 +++++++++++++++++++
drivers/android/binder/freeze.rs | 64 +++++++++++-----
drivers/android/binder/node.rs | 24 ++++--
drivers/android/binder/process.rs | 56 ++++++++++++--
drivers/android/binder/rust_binder_main.rs | 16 +++-
drivers/android/binder/rust_binderfs.c | 3 +
drivers/android/binder/thread.rs | 117 ++++++++++++++++++++---------
drivers/android/binder/transaction.rs | 15 ++++
rust/kernel/task.rs | 7 ++
9 files changed, 309 insertions(+), 69 deletions(-)
---
base-commit: f8d269390cd2a7a9fb5a31f153e7c7b709defea0
change-id: 20260702-rust_binder_debug_mask-636737015624
Best regards,
--
Jahnavi MN <jahnavimn@google.com>
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH v3 1/7] rust_binder: Add dynamic debug logging mask
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
Implement a dynamic debug logging mask (`debug_mask`) for the
`rust_binder` module to allow dynamic runtime configuration of log
levels. This enables parity with the legacy C driver's debug mask.
Since the Rust `module!` macro in the current kernel build does not
yet support declaring module parameters directly in Rust, we define
the `debug_mask` variable in Rust as an `Atomic<u32>` exported via
FFI using `#[no_mangle]`, and link to it as `extern` in a C companion
file to expose it to the kernel runtime.
To verify the setup, instrument process lifecycle events (open, flush,
and release) in `process.rs` under the new `BINDER_DEBUG_OPEN_CLOSE`
logging mask. These entry-point events are chosen for initial validation
because they represent the start of the Binder lifecycle and occur
at low frequency, allowing simple runtime verification of the dynamic
toggle without log noise.
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/debug.rs | 76 ++++++++++++++++++++++++++++++
drivers/android/binder/process.rs | 7 ++-
drivers/android/binder/rust_binder_main.rs | 2 +
drivers/android/binder/rust_binderfs.c | 3 ++
rust/kernel/task.rs | 7 +++
5 files changed, 94 insertions(+), 1 deletion(-)
diff --git a/drivers/android/binder/debug.rs b/drivers/android/binder/debug.rs
new file mode 100644
index 000000000000..824b10c004c3
--- /dev/null
+++ b/drivers/android/binder/debug.rs
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (C) 2026 Google LLC.
+
+//! Binder debugging helpers.
+
+#![allow(dead_code)]
+
+use kernel::bits::bit_u32;
+use kernel::sync::atomic::Atomic;
+
+kernel::impl_flags!(
+ /// Represents multiple debug mask flags.
+ #[derive(Debug, Clone, Default, Copy, PartialEq, Eq)]
+ pub struct DebugMasks(u32);
+
+ /// Represents a single debug mask category.
+ #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+ pub enum DebugMask {
+ UserError = bit_u32(0),
+ FailedTransaction = bit_u32(1),
+ DeadTransaction = bit_u32(2),
+ OpenClose = bit_u32(3),
+ DeadBinder = bit_u32(4),
+ DeathNotification = bit_u32(5),
+ ReadWrite = bit_u32(6),
+ UserRefs = bit_u32(7),
+ Threads = bit_u32(8),
+ Transaction = bit_u32(9),
+ TransactionComplete = bit_u32(10),
+ FreeBuffer = bit_u32(11),
+ InternalRefs = bit_u32(12),
+ PriorityCap = bit_u32(13),
+ Spinlocks = bit_u32(14),
+ }
+);
+
+#[no_mangle]
+pub(crate) static rust_binder_debug_mask: Atomic<u32> = Atomic::new(
+ (DebugMask::UserError as u32)
+ | (DebugMask::FailedTransaction as u32)
+ | (DebugMask::DeadTransaction as u32),
+);
+
+/// Checks if the given debug logging category is enabled in the mask.
+pub(crate) fn debug_mask_enabled(mask: DebugMask) -> bool {
+ let current_mask = rust_binder_debug_mask.load(kernel::sync::atomic::Relaxed);
+ DebugMasks(current_mask).contains(mask)
+}
+
+/// Prints a debug log if the specified mask category is enabled.
+#[macro_export]
+macro_rules! binder_debug {
+ // Rule to explicitly specify a PID (used in kworkers).
+ (pid=$pid:expr, $mask:ident, $($arg:tt)*) => {
+ if $crate::debug::debug_mask_enabled($crate::debug::DebugMask::$mask) {
+ kernel::pr_info!(
+ "{}: {}\n",
+ $pid,
+ kernel::prelude::fmt!($($arg)*)
+ );
+ }
+ };
+
+ // Default rule (automatically prepends "PID:TID" of the current calling thread).
+ ($mask:ident, $($arg:tt)*) => {
+ if $crate::debug::debug_mask_enabled($crate::debug::DebugMask::$mask) {
+ let thread = kernel::current!();
+ kernel::pr_info!(
+ "{}:{} {}\n",
+ thread.tgid(),
+ thread.pid(),
+ kernel::prelude::fmt!($($arg)*)
+ );
+ }
+ };
+}
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 1abeb83684e4..6dd39939e7ae 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1327,6 +1327,7 @@ pub(crate) fn lock_with_nodes(&self) -> WithNodes<'_> {
}
fn deferred_flush(&self) {
+ binder_debug!(pid = self.task.pid(), OpenClose, "flushing process");
let inner = self.inner.lock();
for thread in inner.threads.values() {
thread.exit_looper();
@@ -1334,6 +1335,8 @@ fn deferred_flush(&self) {
}
fn deferred_release(self: Arc<Self>) {
+ binder_debug!(pid = self.task.pid(), OpenClose, "releasing process");
+
let is_manager = {
let mut inner = self.inner.lock();
inner.is_dead = true;
@@ -1627,7 +1630,9 @@ fn ioctl_write_read(
/// The file operations supported by `Process`.
impl Process {
pub(crate) fn open(ctx: ArcBorrow<'_, Context>, file: &File) -> Result<Arc<Process>> {
- Self::new(ctx.into(), ARef::from(file.cred()))
+ let proc = Self::new(ctx.into(), ARef::from(file.cred()))?;
+ binder_debug!(OpenClose, "opened process");
+ Ok(proc)
}
pub(crate) fn release(this: Arc<Process>, _file: &File) {
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 432390aab25b..29829cb210a4 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -31,6 +31,8 @@
mod context;
mod deferred_close;
mod defs;
+#[macro_use]
+mod debug;
mod error;
mod node;
mod page_range;
diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
index ade1c4d92499..300cc65562d1 100644
--- a/drivers/android/binder/rust_binderfs.c
+++ b/drivers/android/binder/rust_binderfs.c
@@ -51,6 +51,9 @@ DEFINE_SHOW_ATTRIBUTE(rust_binder_proc);
char *rust_binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
module_param_named(rust_devices, rust_binder_devices_param, charp, 0444);
+extern u32 rust_binder_debug_mask;
+module_param_named(debug_mask, rust_binder_debug_mask, uint, 0644);
+
static dev_t binderfs_dev;
static DEFINE_MUTEX(binderfs_minors_mutex);
static DEFINE_IDA(binderfs_minors);
diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs
index 38273f4eedb5..1b290c61714d 100644
--- a/rust/kernel/task.rs
+++ b/rust/kernel/task.rs
@@ -210,6 +210,13 @@ pub fn pid(&self) -> Pid {
unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
}
+ /// Returns the TGID (Thread Group ID / Process ID) of the given task.
+ pub fn tgid(&self) -> Pid {
+ // SAFETY: The tgid of a task never changes after initialization, so reading this field is
+ // not a data race.
+ unsafe { *ptr::addr_of!((*self.as_ptr()).tgid) }
+ }
+
/// Returns the UID of the given task.
#[inline]
pub fn uid(&self) -> Kuid {
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 1/7] rust_binder: Add dynamic debug logging mask
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
Implement a dynamic debug logging mask (`debug_mask`) for the
`rust_binder` module to allow dynamic runtime configuration of log
levels. This enables parity with the legacy C driver's debug mask.
Since the Rust `module!` macro in the current kernel build does not
yet support declaring module parameters directly in Rust, we define
the `debug_mask` variable in Rust as an `Atomic<u32>` exported via
FFI using `#[no_mangle]`, and link to it as `extern` in a C companion
file to expose it to the kernel runtime.
To verify the setup, instrument process lifecycle events (open, flush,
and release) in `process.rs` under the new `BINDER_DEBUG_OPEN_CLOSE`
logging mask. These entry-point events are chosen for initial validation
because they represent the start of the Binder lifecycle and occur
at low frequency, allowing simple runtime verification of the dynamic
toggle without log noise.
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/debug.rs | 76 ++++++++++++++++++++++++++++++
drivers/android/binder/process.rs | 7 ++-
drivers/android/binder/rust_binder_main.rs | 2 +
drivers/android/binder/rust_binderfs.c | 3 ++
rust/kernel/task.rs | 7 +++
5 files changed, 94 insertions(+), 1 deletion(-)
diff --git a/drivers/android/binder/debug.rs b/drivers/android/binder/debug.rs
new file mode 100644
index 000000000000..824b10c004c3
--- /dev/null
+++ b/drivers/android/binder/debug.rs
@@ -0,0 +1,76 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright (C) 2026 Google LLC.
+
+//! Binder debugging helpers.
+
+#![allow(dead_code)]
+
+use kernel::bits::bit_u32;
+use kernel::sync::atomic::Atomic;
+
+kernel::impl_flags!(
+ /// Represents multiple debug mask flags.
+ #[derive(Debug, Clone, Default, Copy, PartialEq, Eq)]
+ pub struct DebugMasks(u32);
+
+ /// Represents a single debug mask category.
+ #[derive(Debug, Clone, Copy, PartialEq, Eq)]
+ pub enum DebugMask {
+ UserError = bit_u32(0),
+ FailedTransaction = bit_u32(1),
+ DeadTransaction = bit_u32(2),
+ OpenClose = bit_u32(3),
+ DeadBinder = bit_u32(4),
+ DeathNotification = bit_u32(5),
+ ReadWrite = bit_u32(6),
+ UserRefs = bit_u32(7),
+ Threads = bit_u32(8),
+ Transaction = bit_u32(9),
+ TransactionComplete = bit_u32(10),
+ FreeBuffer = bit_u32(11),
+ InternalRefs = bit_u32(12),
+ PriorityCap = bit_u32(13),
+ Spinlocks = bit_u32(14),
+ }
+);
+
+#[no_mangle]
+pub(crate) static rust_binder_debug_mask: Atomic<u32> = Atomic::new(
+ (DebugMask::UserError as u32)
+ | (DebugMask::FailedTransaction as u32)
+ | (DebugMask::DeadTransaction as u32),
+);
+
+/// Checks if the given debug logging category is enabled in the mask.
+pub(crate) fn debug_mask_enabled(mask: DebugMask) -> bool {
+ let current_mask = rust_binder_debug_mask.load(kernel::sync::atomic::Relaxed);
+ DebugMasks(current_mask).contains(mask)
+}
+
+/// Prints a debug log if the specified mask category is enabled.
+#[macro_export]
+macro_rules! binder_debug {
+ // Rule to explicitly specify a PID (used in kworkers).
+ (pid=$pid:expr, $mask:ident, $($arg:tt)*) => {
+ if $crate::debug::debug_mask_enabled($crate::debug::DebugMask::$mask) {
+ kernel::pr_info!(
+ "{}: {}\n",
+ $pid,
+ kernel::prelude::fmt!($($arg)*)
+ );
+ }
+ };
+
+ // Default rule (automatically prepends "PID:TID" of the current calling thread).
+ ($mask:ident, $($arg:tt)*) => {
+ if $crate::debug::debug_mask_enabled($crate::debug::DebugMask::$mask) {
+ let thread = kernel::current!();
+ kernel::pr_info!(
+ "{}:{} {}\n",
+ thread.tgid(),
+ thread.pid(),
+ kernel::prelude::fmt!($($arg)*)
+ );
+ }
+ };
+}
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 1abeb83684e4..6dd39939e7ae 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1327,6 +1327,7 @@ pub(crate) fn lock_with_nodes(&self) -> WithNodes<'_> {
}
fn deferred_flush(&self) {
+ binder_debug!(pid = self.task.pid(), OpenClose, "flushing process");
let inner = self.inner.lock();
for thread in inner.threads.values() {
thread.exit_looper();
@@ -1334,6 +1335,8 @@ fn deferred_flush(&self) {
}
fn deferred_release(self: Arc<Self>) {
+ binder_debug!(pid = self.task.pid(), OpenClose, "releasing process");
+
let is_manager = {
let mut inner = self.inner.lock();
inner.is_dead = true;
@@ -1627,7 +1630,9 @@ fn ioctl_write_read(
/// The file operations supported by `Process`.
impl Process {
pub(crate) fn open(ctx: ArcBorrow<'_, Context>, file: &File) -> Result<Arc<Process>> {
- Self::new(ctx.into(), ARef::from(file.cred()))
+ let proc = Self::new(ctx.into(), ARef::from(file.cred()))?;
+ binder_debug!(OpenClose, "opened process");
+ Ok(proc)
}
pub(crate) fn release(this: Arc<Process>, _file: &File) {
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 432390aab25b..29829cb210a4 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -31,6 +31,8 @@
mod context;
mod deferred_close;
mod defs;
+#[macro_use]
+mod debug;
mod error;
mod node;
mod page_range;
diff --git a/drivers/android/binder/rust_binderfs.c b/drivers/android/binder/rust_binderfs.c
index ade1c4d92499..300cc65562d1 100644
--- a/drivers/android/binder/rust_binderfs.c
+++ b/drivers/android/binder/rust_binderfs.c
@@ -51,6 +51,9 @@ DEFINE_SHOW_ATTRIBUTE(rust_binder_proc);
char *rust_binder_devices_param = CONFIG_ANDROID_BINDER_DEVICES;
module_param_named(rust_devices, rust_binder_devices_param, charp, 0444);
+extern u32 rust_binder_debug_mask;
+module_param_named(debug_mask, rust_binder_debug_mask, uint, 0644);
+
static dev_t binderfs_dev;
static DEFINE_MUTEX(binderfs_minors_mutex);
static DEFINE_IDA(binderfs_minors);
diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs
index 38273f4eedb5..1b290c61714d 100644
--- a/rust/kernel/task.rs
+++ b/rust/kernel/task.rs
@@ -210,6 +210,13 @@ pub fn pid(&self) -> Pid {
unsafe { *ptr::addr_of!((*self.as_ptr()).pid) }
}
+ /// Returns the TGID (Thread Group ID / Process ID) of the given task.
+ pub fn tgid(&self) -> Pid {
+ // SAFETY: The tgid of a task never changes after initialization, so reading this field is
+ // not a data race.
+ unsafe { *ptr::addr_of!((*self.as_ptr()).tgid) }
+ }
+
/// Returns the UID of the given task.
#[inline]
pub fn uid(&self) -> Kuid {
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH v3 2/7] rust_binder: Implement BINDER_DEBUG_USER_ERROR for freezer-related operation
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
This adds dynamic debug logs for:
- Requesting freeze notifications on invalid references, duplicate
cookies, or already active registrations.
- Completing freeze notifications that are not pending or not found.
- Clearing freeze notifications on invalid references, inactive
notifications, or cookie mismatches.
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/freeze.rs | 40 ++++++++++++++++++++++++++++++----------
1 file changed, 30 insertions(+), 10 deletions(-)
diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs
index 918c4e98b66f..2c99e0995554 100644
--- a/drivers/android/binder/freeze.rs
+++ b/drivers/android/binder/freeze.rs
@@ -182,12 +182,15 @@ pub(crate) fn request_freeze_notif(
info = match node_refs.by_handle.get_mut(&handle) {
Some(info) => info,
None => {
- pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION invalid ref {}\n", handle);
+ binder_debug!(
+ UserError,
+ "BC_REQUEST_FREEZE_NOTIFICATION invalid ref {handle}"
+ );
return Err(EINVAL);
}
};
if info.freeze().is_some() {
- pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION already set\n");
+ binder_debug!(UserError, "BC_REQUEST_FREEZE_NOTIFICATION already set");
return Err(EINVAL);
}
let node_ref = info.node_ref();
@@ -195,7 +198,7 @@ pub(crate) fn request_freeze_notif(
if let rbtree::Entry::Occupied(ref dupe) = freeze_entry {
if !dupe.get().allow_duplicate(&node_ref.node) {
- pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION duplicate cookie\n");
+ binder_debug!(UserError, "BC_REQUEST_FREEZE_NOTIFICATION duplicate cookie");
return Err(EINVAL);
}
}
@@ -260,7 +263,11 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
let mut node_refs_guard = self.node_refs.lock();
let node_refs = &mut *node_refs_guard;
let Some(freeze) = node_refs.freeze_listeners.get_mut(&cookie) else {
- pr_warn!("BC_FREEZE_NOTIFICATION_DONE {:016x} not found\n", cookie.0);
+ binder_debug!(
+ UserError,
+ "BC_FREEZE_NOTIFICATION_DONE {:016x} not found",
+ cookie.0
+ );
return Err(EINVAL);
};
let mut clear_msg = None;
@@ -270,8 +277,9 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
freeze.num_cleared_duplicates += 1;
} else {
if !freeze.is_pending {
- pr_warn!(
- "BC_FREEZE_NOTIFICATION_DONE {:016x} not pending\n",
+ binder_debug!(
+ UserError,
+ "BC_FREEZE_NOTIFICATION_DONE {:016x} not pending",
cookie.0
);
return Err(EINVAL);
@@ -300,19 +308,31 @@ pub(crate) fn clear_freeze_notif(self: &Arc<Self>, reader: &mut UserSliceReader)
let mut node_refs_guard = self.node_refs.lock();
let node_refs = &mut *node_refs_guard;
let Some(info) = node_refs.by_handle.get_mut(&handle) else {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION invalid ref {}\n", handle);
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION invalid ref {handle}"
+ );
return Err(EINVAL);
};
let Some(info_cookie) = info.freeze() else {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active"
+ );
return Err(EINVAL);
};
if *info_cookie != cookie {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch"
+ );
return Err(EINVAL);
}
let Some(listener) = node_refs.freeze_listeners.get_mut(&cookie) else {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION invalid cookie {}\n", handle);
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION invalid cookie {handle}"
+ );
return Err(EINVAL);
};
listener.is_clearing = true;
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 2/7] rust_binder: Implement BINDER_DEBUG_USER_ERROR for freezer-related operation
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
This adds dynamic debug logs for:
- Requesting freeze notifications on invalid references, duplicate
cookies, or already active registrations.
- Completing freeze notifications that are not pending or not found.
- Clearing freeze notifications on invalid references, inactive
notifications, or cookie mismatches.
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/freeze.rs | 40 ++++++++++++++++++++++++++++++----------
1 file changed, 30 insertions(+), 10 deletions(-)
diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs
index 918c4e98b66f..2c99e0995554 100644
--- a/drivers/android/binder/freeze.rs
+++ b/drivers/android/binder/freeze.rs
@@ -182,12 +182,15 @@ pub(crate) fn request_freeze_notif(
info = match node_refs.by_handle.get_mut(&handle) {
Some(info) => info,
None => {
- pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION invalid ref {}\n", handle);
+ binder_debug!(
+ UserError,
+ "BC_REQUEST_FREEZE_NOTIFICATION invalid ref {handle}"
+ );
return Err(EINVAL);
}
};
if info.freeze().is_some() {
- pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION already set\n");
+ binder_debug!(UserError, "BC_REQUEST_FREEZE_NOTIFICATION already set");
return Err(EINVAL);
}
let node_ref = info.node_ref();
@@ -195,7 +198,7 @@ pub(crate) fn request_freeze_notif(
if let rbtree::Entry::Occupied(ref dupe) = freeze_entry {
if !dupe.get().allow_duplicate(&node_ref.node) {
- pr_warn!("BC_REQUEST_FREEZE_NOTIFICATION duplicate cookie\n");
+ binder_debug!(UserError, "BC_REQUEST_FREEZE_NOTIFICATION duplicate cookie");
return Err(EINVAL);
}
}
@@ -260,7 +263,11 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
let mut node_refs_guard = self.node_refs.lock();
let node_refs = &mut *node_refs_guard;
let Some(freeze) = node_refs.freeze_listeners.get_mut(&cookie) else {
- pr_warn!("BC_FREEZE_NOTIFICATION_DONE {:016x} not found\n", cookie.0);
+ binder_debug!(
+ UserError,
+ "BC_FREEZE_NOTIFICATION_DONE {:016x} not found",
+ cookie.0
+ );
return Err(EINVAL);
};
let mut clear_msg = None;
@@ -270,8 +277,9 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
freeze.num_cleared_duplicates += 1;
} else {
if !freeze.is_pending {
- pr_warn!(
- "BC_FREEZE_NOTIFICATION_DONE {:016x} not pending\n",
+ binder_debug!(
+ UserError,
+ "BC_FREEZE_NOTIFICATION_DONE {:016x} not pending",
cookie.0
);
return Err(EINVAL);
@@ -300,19 +308,31 @@ pub(crate) fn clear_freeze_notif(self: &Arc<Self>, reader: &mut UserSliceReader)
let mut node_refs_guard = self.node_refs.lock();
let node_refs = &mut *node_refs_guard;
let Some(info) = node_refs.by_handle.get_mut(&handle) else {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION invalid ref {}\n", handle);
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION invalid ref {handle}"
+ );
return Err(EINVAL);
};
let Some(info_cookie) = info.freeze() else {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION freeze notification not active"
+ );
return Err(EINVAL);
};
if *info_cookie != cookie {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION freeze notification cookie mismatch"
+ );
return Err(EINVAL);
}
let Some(listener) = node_refs.freeze_listeners.get_mut(&cookie) else {
- pr_warn!("BC_CLEAR_FREEZE_NOTIFICATION invalid cookie {}\n", handle);
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_FREEZE_NOTIFICATION invalid cookie {handle}"
+ );
return Err(EINVAL);
};
listener.is_clearing = true;
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH v3 3/7] rust_binder: Implement BINDER_DEBUG_USER_ERROR for refcounting and death notifications
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
This adds dynamic debug logs for:
- Decrementing handle reference counts that are already zero.
- Mismatched reference states (calling inc_ref_done with no active
inc_refs, or using a weak reference as a strong reference).
- Requesting or clearing death notifications on invalid references,
already active notifications, or with mismatched cookies.
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/node.rs | 10 ++++++----
drivers/android/binder/process.rs | 35 ++++++++++++++++++++++++++++-------
2 files changed, 34 insertions(+), 11 deletions(-)
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index fb57c0b20888..3f0757058b84 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -345,7 +345,7 @@ pub(crate) fn inc_ref_done_locked(
) -> Option<DLArc<Node>> {
let inner = self.inner.access_mut(owner_inner);
if inner.active_inc_refs == 0 {
- pr_err!("inc_ref_done called when no active inc_refs");
+ binder_debug!(UserError, "inc_ref_done called when no active inc_refs");
return None;
}
@@ -819,6 +819,7 @@ pub(crate) fn get_count(&self) -> (usize, usize) {
pub(crate) fn clone(&self, strong: bool) -> Result<NodeRef> {
if strong && self.strong_count == 0 {
+ binder_debug!(UserError, "tried to use weak ref as strong ref");
return Err(EINVAL);
}
Ok(self
@@ -859,9 +860,10 @@ pub(crate) fn update(&mut self, inc: bool, strong: bool) -> bool {
*count += 1;
} else {
if *count == 0 {
- pr_warn!(
- "pid {} performed invalid decrement on ref\n",
- kernel::current!().pid()
+ binder_debug!(
+ UserError,
+ "performed invalid {} decrement on ref",
+ if strong { "strong" } else { "weak" }
);
return false;
}
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 6dd39939e7ae..38190aaa462d 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -908,7 +908,13 @@ pub(crate) fn get_transaction_node(&self, handle: u32) -> BinderResult<NodeRef>
if handle == 0 {
Ok(self.ctx.get_manager_node(true)?)
} else {
- Ok(self.get_node_from_handle(handle, true)?)
+ match self.get_node_from_handle(handle, true) {
+ Ok(node_ref) => Ok(node_ref),
+ Err(err) => {
+ binder_debug!(UserError, "got transaction to invalid handle {handle}");
+ Err(err.into())
+ }
+ }
}
}
@@ -983,7 +989,7 @@ pub(crate) fn update_ref(
} else {
// All refs are cleared in process exit, so this warning is expected in that case.
if !self.inner.lock().is_dead {
- pr_warn!("{}: no such ref {handle}\n", self.pid_in_current_ns());
+ binder_debug!(UserError, "no such ref {handle}");
}
}
Ok(())
@@ -1236,13 +1242,19 @@ pub(crate) fn request_death(
})?;
let mut refs = self.node_refs.lock();
let Some(info) = refs.by_handle.get_mut(&handle) else {
- pr_warn!("BC_REQUEST_DEATH_NOTIFICATION invalid ref {handle}\n");
+ binder_debug!(
+ UserError,
+ "BC_REQUEST_DEATH_NOTIFICATION invalid ref {handle}"
+ );
return Ok(());
};
// Nothing to do if there is already a death notification request for this handle.
if info.death().is_some() {
- pr_warn!("BC_REQUEST_DEATH_NOTIFICATION death notification already set\n");
+ binder_debug!(
+ UserError,
+ "BC_REQUEST_DEATH_NOTIFICATION death notification already set"
+ );
return Ok(());
}
@@ -1279,17 +1291,26 @@ pub(crate) fn clear_death(&self, reader: &mut UserSliceReader, thread: &Thread)
let mut refs = self.node_refs.lock();
let Some(info) = refs.by_handle.get_mut(&handle) else {
- pr_warn!("BC_CLEAR_DEATH_NOTIFICATION invalid ref {handle}\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_DEATH_NOTIFICATION invalid ref {handle}"
+ );
return Ok(());
};
let Some(death) = info.death().take() else {
- pr_warn!("BC_CLEAR_DEATH_NOTIFICATION death notification not active\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_DEATH_NOTIFICATION death notification not active"
+ );
return Ok(());
};
if death.cookie != cookie {
*info.death() = Some(death);
- pr_warn!("BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch"
+ );
return Ok(());
}
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 3/7] rust_binder: Implement BINDER_DEBUG_USER_ERROR for refcounting and death notifications
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
This adds dynamic debug logs for:
- Decrementing handle reference counts that are already zero.
- Mismatched reference states (calling inc_ref_done with no active
inc_refs, or using a weak reference as a strong reference).
- Requesting or clearing death notifications on invalid references,
already active notifications, or with mismatched cookies.
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/node.rs | 10 ++++++----
drivers/android/binder/process.rs | 35 ++++++++++++++++++++++++++++-------
2 files changed, 34 insertions(+), 11 deletions(-)
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index fb57c0b20888..3f0757058b84 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -345,7 +345,7 @@ pub(crate) fn inc_ref_done_locked(
) -> Option<DLArc<Node>> {
let inner = self.inner.access_mut(owner_inner);
if inner.active_inc_refs == 0 {
- pr_err!("inc_ref_done called when no active inc_refs");
+ binder_debug!(UserError, "inc_ref_done called when no active inc_refs");
return None;
}
@@ -819,6 +819,7 @@ pub(crate) fn get_count(&self) -> (usize, usize) {
pub(crate) fn clone(&self, strong: bool) -> Result<NodeRef> {
if strong && self.strong_count == 0 {
+ binder_debug!(UserError, "tried to use weak ref as strong ref");
return Err(EINVAL);
}
Ok(self
@@ -859,9 +860,10 @@ pub(crate) fn update(&mut self, inc: bool, strong: bool) -> bool {
*count += 1;
} else {
if *count == 0 {
- pr_warn!(
- "pid {} performed invalid decrement on ref\n",
- kernel::current!().pid()
+ binder_debug!(
+ UserError,
+ "performed invalid {} decrement on ref",
+ if strong { "strong" } else { "weak" }
);
return false;
}
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 6dd39939e7ae..38190aaa462d 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -908,7 +908,13 @@ pub(crate) fn get_transaction_node(&self, handle: u32) -> BinderResult<NodeRef>
if handle == 0 {
Ok(self.ctx.get_manager_node(true)?)
} else {
- Ok(self.get_node_from_handle(handle, true)?)
+ match self.get_node_from_handle(handle, true) {
+ Ok(node_ref) => Ok(node_ref),
+ Err(err) => {
+ binder_debug!(UserError, "got transaction to invalid handle {handle}");
+ Err(err.into())
+ }
+ }
}
}
@@ -983,7 +989,7 @@ pub(crate) fn update_ref(
} else {
// All refs are cleared in process exit, so this warning is expected in that case.
if !self.inner.lock().is_dead {
- pr_warn!("{}: no such ref {handle}\n", self.pid_in_current_ns());
+ binder_debug!(UserError, "no such ref {handle}");
}
}
Ok(())
@@ -1236,13 +1242,19 @@ pub(crate) fn request_death(
})?;
let mut refs = self.node_refs.lock();
let Some(info) = refs.by_handle.get_mut(&handle) else {
- pr_warn!("BC_REQUEST_DEATH_NOTIFICATION invalid ref {handle}\n");
+ binder_debug!(
+ UserError,
+ "BC_REQUEST_DEATH_NOTIFICATION invalid ref {handle}"
+ );
return Ok(());
};
// Nothing to do if there is already a death notification request for this handle.
if info.death().is_some() {
- pr_warn!("BC_REQUEST_DEATH_NOTIFICATION death notification already set\n");
+ binder_debug!(
+ UserError,
+ "BC_REQUEST_DEATH_NOTIFICATION death notification already set"
+ );
return Ok(());
}
@@ -1279,17 +1291,26 @@ pub(crate) fn clear_death(&self, reader: &mut UserSliceReader, thread: &Thread)
let mut refs = self.node_refs.lock();
let Some(info) = refs.by_handle.get_mut(&handle) else {
- pr_warn!("BC_CLEAR_DEATH_NOTIFICATION invalid ref {handle}\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_DEATH_NOTIFICATION invalid ref {handle}"
+ );
return Ok(());
};
let Some(death) = info.death().take() else {
- pr_warn!("BC_CLEAR_DEATH_NOTIFICATION death notification not active\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_DEATH_NOTIFICATION death notification not active"
+ );
return Ok(());
};
if death.cookie != cookie {
*info.death() = Some(death);
- pr_warn!("BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch\n");
+ binder_debug!(
+ UserError,
+ "BC_CLEAR_DEATH_NOTIFICATION death notification cookie mismatch"
+ );
return Ok(());
}
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH v3 4/7] rust_binder: Implement BINDER_DEBUG_USER_ERROR for transaction parsing failures
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
This adds dynamic debug logs in `thread.rs` for:
- File descriptor array (FDA) parent offset and parent buffer address
alignment misalignments.
- Memory copy, write, and translation failures during transaction
serialization (including out-of-bounds pointer fixups).
- Incoming transactions or replies that do not match the expected
thread calling stack (such as out-of-order replies).
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/thread.rs | 54 ++++++++++++++++++++++++----------------
1 file changed, 32 insertions(+), 22 deletions(-)
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 87298a8c597d..072cb4674172 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -721,11 +721,12 @@ fn translate_object(
let alloc_offset = match sg_state.unused_buffer_space.claim_next(obj_length) {
Ok(alloc_offset) => alloc_offset,
Err(err) => {
- pr_warn!(
- "Failed to claim space for a BINDER_TYPE_PTR. (offset: {}, limit: {}, size: {})",
+ binder_debug!(
+ UserError,
+ "failed to claim space for a BINDER_TYPE_PTR (offset: {}, limit: {}, size: {})",
sg_state.unused_buffer_space.offset,
sg_state.unused_buffer_space.limit,
- obj_length,
+ obj_length
);
return Err(err.into());
}
@@ -804,6 +805,7 @@ fn translate_object(
let fds_len = num_fds.checked_mul(size_of::<u32>()).ok_or(EINVAL)?;
if !is_aligned(parent_offset, size_of::<u32>()) {
+ binder_debug!(UserError, "FDA parent offset not aligned correctly");
return Err(EINVAL.into());
}
@@ -822,6 +824,7 @@ fn translate_object(
};
if !is_aligned(parent_entry.sender_uaddr, size_of::<u32>()) {
+ binder_debug!(UserError, "FDA parent buffer not aligned correctly");
return Err(EINVAL.into());
}
@@ -905,12 +908,9 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let target_offset_end = fixup_offset.checked_add(fixup_len).ok_or(EINVAL)?;
if fixup_offset < end_of_previous_fixup || offset_end < target_offset_end {
- pr_warn!(
- "Fixups oob {} {} {} {}",
- fixup_offset,
- end_of_previous_fixup,
- offset_end,
- target_offset_end
+ binder_debug!(
+ UserError,
+ "fixups oob {fixup_offset} {end_of_previous_fixup} {offset_end} {target_offset_end}"
);
return Err(EINVAL.into());
}
@@ -918,18 +918,21 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let copy_off = end_of_previous_fixup;
let copy_len = fixup_offset - end_of_previous_fixup;
if let Err(err) = alloc.copy_into(&mut reader, copy_off, copy_len) {
- pr_warn!("Failed copying into alloc: {:?}", err);
+ binder_debug!(UserError, "failed copying into alloc: {err:?}");
return Err(err.into());
}
if let PointerFixupEntry::Fixup { pointer_value, .. } = fixup {
let res = alloc.write::<u64>(fixup_offset, pointer_value);
if let Err(err) = res {
- pr_warn!("Failed copying ptr into alloc: {:?}", err);
+ binder_debug!(UserError, "failed copying ptr into alloc: {err:?}");
return Err(err.into());
}
}
if let Err(err) = reader.skip(fixup_len) {
- pr_warn!("Failed skipping {} from reader: {:?}", fixup_len, err);
+ binder_debug!(
+ UserError,
+ "failed skipping {fixup_len} from reader: {err:?}"
+ );
return Err(err.into());
}
end_of_previous_fixup = target_offset_end;
@@ -937,7 +940,7 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let copy_off = end_of_previous_fixup;
let copy_len = offset_end - end_of_previous_fixup;
if let Err(err) = alloc.copy_into(&mut reader, copy_off, copy_len) {
- pr_warn!("Failed copying remainder into alloc: {:?}", err);
+ binder_debug!(UserError, "failed copying remainder into alloc: {err:?}");
return Err(err.into());
}
}
@@ -1041,7 +1044,7 @@ pub(crate) fn copy_transaction_data(
let offset: usize = offset.try_into().map_err(|_| EINVAL)?;
if offset < end_of_previous_object || !is_aligned(offset, size_of::<u32>()) {
- pr_warn!("Got transaction with invalid offset.");
+ binder_debug!(UserError, "got transaction with invalid offset");
return Err(EINVAL.into());
}
@@ -1066,7 +1069,7 @@ pub(crate) fn copy_transaction_data(
) {
Ok(()) => end_of_previous_object = offset + object.size(),
Err(err) => {
- pr_warn!("Error while translating object.");
+ binder_debug!(UserError, "error while translating object: {err:?}");
return Err(err);
}
}
@@ -1086,15 +1089,12 @@ pub(crate) fn copy_transaction_data(
)?;
if let Some(sg_state) = sg_state.as_mut() {
- if let Err(err) = self.apply_sg(&mut alloc, sg_state) {
- pr_warn!("Failure in apply_sg: {:?}", err);
- return Err(err);
- }
+ self.apply_sg(&mut alloc, sg_state)?;
}
if let Some((off_out, secctx)) = secctx.as_mut() {
if let Err(err) = alloc.write(secctx_off, secctx.as_bytes()) {
- pr_warn!("Failed to write security context: {:?}", err);
+ binder_debug!(UserError, "failed to write security context: {err:?}");
return Err(err.into());
}
**off_out = secctx_off;
@@ -1282,7 +1282,7 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
{
let mut inner = self.inner.lock();
if !transaction.is_stacked_on(&inner.current_transaction) {
- pr_warn!("Transaction stack changed during transaction!");
+ binder_debug!(UserError, "got new transaction with bad transaction stack");
return Err(EINVAL.into());
}
inner.current_transaction = Some(transaction.clone_arc());
@@ -1305,8 +1305,18 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
}
fn reply_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResult {
- let orig = self.inner.lock().pop_transaction_to_reply(self)?;
+ let orig = match self.inner.lock().pop_transaction_to_reply(self) {
+ Ok(orig) => orig,
+ Err(err) => {
+ binder_debug!(UserError, "got reply transaction with no transaction stack");
+ return Err(err.into());
+ }
+ };
if !orig.from.is_current_transaction(&orig) {
+ binder_debug!(
+ UserError,
+ "got reply transaction with bad transaction stack"
+ );
return Err(EINVAL.into());
}
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 4/7] rust_binder: Implement BINDER_DEBUG_USER_ERROR for transaction parsing failures
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
This adds dynamic debug logs in `thread.rs` for:
- File descriptor array (FDA) parent offset and parent buffer address
alignment misalignments.
- Memory copy, write, and translation failures during transaction
serialization (including out-of-bounds pointer fixups).
- Incoming transactions or replies that do not match the expected
thread calling stack (such as out-of-order replies).
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/thread.rs | 54 ++++++++++++++++++++++++----------------
1 file changed, 32 insertions(+), 22 deletions(-)
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 87298a8c597d..072cb4674172 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -721,11 +721,12 @@ fn translate_object(
let alloc_offset = match sg_state.unused_buffer_space.claim_next(obj_length) {
Ok(alloc_offset) => alloc_offset,
Err(err) => {
- pr_warn!(
- "Failed to claim space for a BINDER_TYPE_PTR. (offset: {}, limit: {}, size: {})",
+ binder_debug!(
+ UserError,
+ "failed to claim space for a BINDER_TYPE_PTR (offset: {}, limit: {}, size: {})",
sg_state.unused_buffer_space.offset,
sg_state.unused_buffer_space.limit,
- obj_length,
+ obj_length
);
return Err(err.into());
}
@@ -804,6 +805,7 @@ fn translate_object(
let fds_len = num_fds.checked_mul(size_of::<u32>()).ok_or(EINVAL)?;
if !is_aligned(parent_offset, size_of::<u32>()) {
+ binder_debug!(UserError, "FDA parent offset not aligned correctly");
return Err(EINVAL.into());
}
@@ -822,6 +824,7 @@ fn translate_object(
};
if !is_aligned(parent_entry.sender_uaddr, size_of::<u32>()) {
+ binder_debug!(UserError, "FDA parent buffer not aligned correctly");
return Err(EINVAL.into());
}
@@ -905,12 +908,9 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let target_offset_end = fixup_offset.checked_add(fixup_len).ok_or(EINVAL)?;
if fixup_offset < end_of_previous_fixup || offset_end < target_offset_end {
- pr_warn!(
- "Fixups oob {} {} {} {}",
- fixup_offset,
- end_of_previous_fixup,
- offset_end,
- target_offset_end
+ binder_debug!(
+ UserError,
+ "fixups oob {fixup_offset} {end_of_previous_fixup} {offset_end} {target_offset_end}"
);
return Err(EINVAL.into());
}
@@ -918,18 +918,21 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let copy_off = end_of_previous_fixup;
let copy_len = fixup_offset - end_of_previous_fixup;
if let Err(err) = alloc.copy_into(&mut reader, copy_off, copy_len) {
- pr_warn!("Failed copying into alloc: {:?}", err);
+ binder_debug!(UserError, "failed copying into alloc: {err:?}");
return Err(err.into());
}
if let PointerFixupEntry::Fixup { pointer_value, .. } = fixup {
let res = alloc.write::<u64>(fixup_offset, pointer_value);
if let Err(err) = res {
- pr_warn!("Failed copying ptr into alloc: {:?}", err);
+ binder_debug!(UserError, "failed copying ptr into alloc: {err:?}");
return Err(err.into());
}
}
if let Err(err) = reader.skip(fixup_len) {
- pr_warn!("Failed skipping {} from reader: {:?}", fixup_len, err);
+ binder_debug!(
+ UserError,
+ "failed skipping {fixup_len} from reader: {err:?}"
+ );
return Err(err.into());
}
end_of_previous_fixup = target_offset_end;
@@ -937,7 +940,7 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let copy_off = end_of_previous_fixup;
let copy_len = offset_end - end_of_previous_fixup;
if let Err(err) = alloc.copy_into(&mut reader, copy_off, copy_len) {
- pr_warn!("Failed copying remainder into alloc: {:?}", err);
+ binder_debug!(UserError, "failed copying remainder into alloc: {err:?}");
return Err(err.into());
}
}
@@ -1041,7 +1044,7 @@ pub(crate) fn copy_transaction_data(
let offset: usize = offset.try_into().map_err(|_| EINVAL)?;
if offset < end_of_previous_object || !is_aligned(offset, size_of::<u32>()) {
- pr_warn!("Got transaction with invalid offset.");
+ binder_debug!(UserError, "got transaction with invalid offset");
return Err(EINVAL.into());
}
@@ -1066,7 +1069,7 @@ pub(crate) fn copy_transaction_data(
) {
Ok(()) => end_of_previous_object = offset + object.size(),
Err(err) => {
- pr_warn!("Error while translating object.");
+ binder_debug!(UserError, "error while translating object: {err:?}");
return Err(err);
}
}
@@ -1086,15 +1089,12 @@ pub(crate) fn copy_transaction_data(
)?;
if let Some(sg_state) = sg_state.as_mut() {
- if let Err(err) = self.apply_sg(&mut alloc, sg_state) {
- pr_warn!("Failure in apply_sg: {:?}", err);
- return Err(err);
- }
+ self.apply_sg(&mut alloc, sg_state)?;
}
if let Some((off_out, secctx)) = secctx.as_mut() {
if let Err(err) = alloc.write(secctx_off, secctx.as_bytes()) {
- pr_warn!("Failed to write security context: {:?}", err);
+ binder_debug!(UserError, "failed to write security context: {err:?}");
return Err(err.into());
}
**off_out = secctx_off;
@@ -1282,7 +1282,7 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
{
let mut inner = self.inner.lock();
if !transaction.is_stacked_on(&inner.current_transaction) {
- pr_warn!("Transaction stack changed during transaction!");
+ binder_debug!(UserError, "got new transaction with bad transaction stack");
return Err(EINVAL.into());
}
inner.current_transaction = Some(transaction.clone_arc());
@@ -1305,8 +1305,18 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
}
fn reply_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResult {
- let orig = self.inner.lock().pop_transaction_to_reply(self)?;
+ let orig = match self.inner.lock().pop_transaction_to_reply(self) {
+ Ok(orig) => orig,
+ Err(err) => {
+ binder_debug!(UserError, "got reply transaction with no transaction stack");
+ return Err(err.into());
+ }
+ };
if !orig.from.is_current_transaction(&orig) {
+ binder_debug!(
+ UserError,
+ "got reply transaction with bad transaction stack"
+ );
return Err(EINVAL.into());
}
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH v3 5/7] rust_binder: Implement BINDER_DEBUG_FAILED_TRANSACTION
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
This adds dynamic debug logs for:
- Failed replies, target process deaths, and error code deliveries.
- Detailed transaction failure diagnostics (including sender/receiver
PIDs, TIDs, transaction IDs, buffer sizes, and error codes).
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/thread.rs | 21 ++++++++++++++++-----
drivers/android/binder/transaction.rs | 8 ++++++++
2 files changed, 24 insertions(+), 5 deletions(-)
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 072cb4674172..26925d094a59 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -1254,11 +1254,22 @@ fn transaction(self: &Arc<Self>, cmd: u32, reader: &mut UserSliceReader) -> Resu
ee.param = source.to_errno();
}
- pr_warn!(
- "{}:{} transaction to {} failed: {source:?}",
- info.from_pid,
- info.from_tid,
- info.to_pid
+ binder_debug!(
+ FailedTransaction,
+ "transaction {} to {}:{} failed {:?}, code {} size {}-{}",
+ if info.is_reply {
+ "reply"
+ } else if info.is_oneway() {
+ "async"
+ } else {
+ "call"
+ },
+ info.to_pid,
+ info.to_tid,
+ err,
+ info.code,
+ info.data_size,
+ info.offsets_size
);
}
}
diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs
index 38795224a784..b56dca55662d 100644
--- a/drivers/android/binder/transaction.rs
+++ b/drivers/android/binder/transaction.rs
@@ -405,6 +405,14 @@ fn do_work(
} else {
// On failure to process the list, we send a reply back to the sender and ignore the
// transaction on the recipient.
+ binder_debug!(
+ FailedTransaction,
+ "transaction {} to {} failed, fd fixups failed, size {}-{}",
+ self.debug_id,
+ self.to.task.pid(),
+ self.data_size,
+ self.offsets_size
+ );
return Ok(true);
};
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 5/7] rust_binder: Implement BINDER_DEBUG_FAILED_TRANSACTION
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
This adds dynamic debug logs for:
- Failed replies, target process deaths, and error code deliveries.
- Detailed transaction failure diagnostics (including sender/receiver
PIDs, TIDs, transaction IDs, buffer sizes, and error codes).
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/thread.rs | 21 ++++++++++++++++-----
drivers/android/binder/transaction.rs | 8 ++++++++
2 files changed, 24 insertions(+), 5 deletions(-)
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 072cb4674172..26925d094a59 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -1254,11 +1254,22 @@ fn transaction(self: &Arc<Self>, cmd: u32, reader: &mut UserSliceReader) -> Resu
ee.param = source.to_errno();
}
- pr_warn!(
- "{}:{} transaction to {} failed: {source:?}",
- info.from_pid,
- info.from_tid,
- info.to_pid
+ binder_debug!(
+ FailedTransaction,
+ "transaction {} to {}:{} failed {:?}, code {} size {}-{}",
+ if info.is_reply {
+ "reply"
+ } else if info.is_oneway() {
+ "async"
+ } else {
+ "call"
+ },
+ info.to_pid,
+ info.to_tid,
+ err,
+ info.code,
+ info.data_size,
+ info.offsets_size
);
}
}
diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs
index 38795224a784..b56dca55662d 100644
--- a/drivers/android/binder/transaction.rs
+++ b/drivers/android/binder/transaction.rs
@@ -405,6 +405,14 @@ fn do_work(
} else {
// On failure to process the list, we send a reply back to the sender and ignore the
// transaction on the recipient.
+ binder_debug!(
+ FailedTransaction,
+ "transaction {} to {} failed, fd fixups failed, size {}-{}",
+ self.debug_id,
+ self.to.task.pid(),
+ self.data_size,
+ self.offsets_size
+ );
return Ok(true);
};
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH v3 6/7] rust_binder: Implement BINDER_DEBUG_DEATH_NOTIFICATION
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
This adds dynamic debug logs for:
- Memory allocation (OOM) failures when requesting
death notifications
- Registration and cancellation lifecycle events
(BC_REQUEST / BC_CLEAR)
- Delivery of death notification events to userspace
(BR_DEAD_BINDER)
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/node.rs | 5 +++++
drivers/android/binder/process.rs | 14 ++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 3f0757058b84..87a2e613a816 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -1105,6 +1105,11 @@ fn do_work(
// We're still holding the inner lock, so it cannot be aborted while we insert it into
// the delivered list.
process_inner.death_delivered(self.clone());
+ binder_debug!(
+ DeathNotification,
+ "sending death notification, cookie {:016x}",
+ cookie
+ );
BR_DEAD_BINDER
};
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 38190aaa462d..42330fd409c4 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1239,6 +1239,10 @@ pub(crate) fn request_death(
// Queue BR_ERROR if we can't allocate memory for the death notification.
let death = UniqueArc::new_uninit(GFP_KERNEL).inspect_err(|_| {
thread.push_return_work(BR_ERROR);
+ binder_debug!(
+ DeathNotification,
+ "BC_REQUEST_DEATH_NOTIFICATION failed due to memory allocation failure"
+ );
})?;
let mut refs = self.node_refs.lock();
let Some(info) = refs.by_handle.get_mut(&handle) else {
@@ -1282,6 +1286,11 @@ pub(crate) fn request_death(
info.node_ref().node.add_death(death, &mut owner_inner);
}
}
+ binder_debug!(
+ DeathNotification,
+ "BC_REQUEST_DEATH_NOTIFICATION handle {handle} cookie {:016x}",
+ cookie
+ );
Ok(())
}
@@ -1325,6 +1334,11 @@ pub(crate) fn clear_death(&self, reader: &mut UserSliceReader, thread: &Thread)
}
}
+ binder_debug!(
+ DeathNotification,
+ "BC_CLEAR_DEATH_NOTIFICATION handle {handle} cookie {:016x}",
+ cookie
+ );
Ok(())
}
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 6/7] rust_binder: Implement BINDER_DEBUG_DEATH_NOTIFICATION
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
This adds dynamic debug logs for:
- Memory allocation (OOM) failures when requesting
death notifications
- Registration and cancellation lifecycle events
(BC_REQUEST / BC_CLEAR)
- Delivery of death notification events to userspace
(BR_DEAD_BINDER)
Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/node.rs | 5 +++++
drivers/android/binder/process.rs | 14 ++++++++++++++
2 files changed, 19 insertions(+)
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 3f0757058b84..87a2e613a816 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -1105,6 +1105,11 @@ fn do_work(
// We're still holding the inner lock, so it cannot be aborted while we insert it into
// the delivered list.
process_inner.death_delivered(self.clone());
+ binder_debug!(
+ DeathNotification,
+ "sending death notification, cookie {:016x}",
+ cookie
+ );
BR_DEAD_BINDER
};
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 38190aaa462d..42330fd409c4 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1239,6 +1239,10 @@ pub(crate) fn request_death(
// Queue BR_ERROR if we can't allocate memory for the death notification.
let death = UniqueArc::new_uninit(GFP_KERNEL).inspect_err(|_| {
thread.push_return_work(BR_ERROR);
+ binder_debug!(
+ DeathNotification,
+ "BC_REQUEST_DEATH_NOTIFICATION failed due to memory allocation failure"
+ );
})?;
let mut refs = self.node_refs.lock();
let Some(info) = refs.by_handle.get_mut(&handle) else {
@@ -1282,6 +1286,11 @@ pub(crate) fn request_death(
info.node_ref().node.add_death(death, &mut owner_inner);
}
}
+ binder_debug!(
+ DeathNotification,
+ "BC_REQUEST_DEATH_NOTIFICATION handle {handle} cookie {:016x}",
+ cookie
+ );
Ok(())
}
@@ -1325,6 +1334,11 @@ pub(crate) fn clear_death(&self, reader: &mut UserSliceReader, thread: &Thread)
}
}
+ binder_debug!(
+ DeathNotification,
+ "BC_CLEAR_DEATH_NOTIFICATION handle {handle} cookie {:016x}",
+ cookie
+ );
Ok(())
}
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [PATCH v3 7/7] rust_binder: Implement BINDER_DEBUG_DEAD_TRANSACTION
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
-1 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
This adds dynamic debug logs for:
- Releasing active transactions during thread stack unwinding.
- Discarded transaction error codes when a thread exits.
- Undelivered transaction acknowledgments (TRANSACTION_COMPLETE)
upon thread exit.
- Undelivered process death and freeze notifications when processes
exit or die.
- Undelivered transactions canceled due to target process death.
We now store the process PID in `ThreadError`, `DeliverCode`, and
`FreezeMessage` to ensure the correct PID is logged on cancellation.
This is necessary because `cancel()` runs from background `kworkers`,
which would otherwise print the wrong PID.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/freeze.rs | 24 +++++++++++------
drivers/android/binder/node.rs | 9 ++++++-
drivers/android/binder/rust_binder_main.rs | 14 ++++++++--
drivers/android/binder/thread.rs | 42 +++++++++++++++++++++++-------
drivers/android/binder/transaction.rs | 7 +++++
5 files changed, 76 insertions(+), 20 deletions(-)
diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs
index 2c99e0995554..7b825ffba557 100644
--- a/drivers/android/binder/freeze.rs
+++ b/drivers/android/binder/freeze.rs
@@ -60,6 +60,7 @@ fn allow_duplicate(&self, node: &DArc<Node>) -> bool {
/// Represents a notification that the freeze state has changed.
pub(crate) struct FreezeMessage {
cookie: FreezeCookie,
+ pid: i32,
}
kernel::list::impl_list_arc_safe! {
@@ -73,8 +74,8 @@ fn new(flags: kernel::alloc::Flags) -> Result<UninitFM, AllocError> {
UniqueArc::new_uninit(flags)
}
- fn init(ua: UninitFM, cookie: FreezeCookie) -> DLArc<FreezeMessage> {
- match ua.pin_init_with(DTRWrap::new(FreezeMessage { cookie })) {
+ fn init(ua: UninitFM, cookie: FreezeCookie, pid: i32) -> DLArc<FreezeMessage> {
+ match ua.pin_init_with(DTRWrap::new(FreezeMessage { cookie, pid })) {
Ok(msg) => ListArc::from(msg),
Err(err) => match err {},
}
@@ -140,7 +141,14 @@ fn do_work(
}
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ binder_debug!(
+ pid = self.pid,
+ DeadTransaction,
+ "undelivered freeze notification, {:016x}",
+ self.cookie.0
+ );
+ }
fn should_sync_wakeup(&self) -> bool {
false
@@ -251,7 +259,7 @@ pub(crate) fn request_freeze_notif(
}
*info.freeze() = Some(cookie);
- let msg = FreezeMessage::init(msg, cookie);
+ let msg = FreezeMessage::init(msg, cookie, self.task.pid());
drop(node_refs_guard);
let _ = self.push_work(msg);
Ok(())
@@ -272,7 +280,7 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
};
let mut clear_msg = None;
if freeze.num_pending_duplicates > 0 {
- clear_msg = Some(FreezeMessage::init(alloc, cookie));
+ clear_msg = Some(FreezeMessage::init(alloc, cookie, self.task.pid()));
freeze.num_pending_duplicates -= 1;
freeze.num_cleared_duplicates += 1;
} else {
@@ -287,7 +295,7 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
let is_frozen = freeze.node.owner.inner.lock().is_frozen.is_fully_frozen();
if freeze.is_clearing || freeze.last_is_frozen != Some(is_frozen) {
// Immediately send another FreezeMessage.
- clear_msg = Some(FreezeMessage::init(alloc, cookie));
+ clear_msg = Some(FreezeMessage::init(alloc, cookie, self.task.pid()));
}
freeze.is_pending = false;
}
@@ -340,7 +348,7 @@ pub(crate) fn clear_freeze_notif(self: &Arc<Self>, reader: &mut UserSliceReader)
*info.freeze() = None;
let mut msg = None;
if !listener.is_pending {
- msg = Some(FreezeMessage::init(alloc, cookie));
+ msg = Some(FreezeMessage::init(alloc, cookie, self.task.pid()));
}
drop(node_refs_guard);
@@ -420,7 +428,7 @@ pub(crate) fn prepare_freeze_messages(&self) -> Result<FreezeMessages, AllocErro
continue;
};
let msg_alloc = FreezeMessage::new(GFP_KERNEL)?;
- let msg = FreezeMessage::init(msg_alloc, cookie);
+ let msg = FreezeMessage::init(msg_alloc, cookie, proc.task.pid());
batch.push((proc, msg), GFP_KERNEL)?;
}
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 87a2e613a816..b9e21b8ec251 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -1120,7 +1120,14 @@ fn do_work(
Ok(cmd != BR_DEAD_BINDER)
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ binder_debug!(
+ pid = self.process.task.pid(),
+ DeadTransaction,
+ "undelivered death notification, {:016x}",
+ self.cookie
+ );
+ }
fn should_sync_wakeup(&self) -> bool {
false
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 29829cb210a4..15c7b65928d8 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -221,6 +221,7 @@ fn arc_pin_init(init: impl PinInit<T>) -> Result<DLArc<T>, kernel::error::Error>
struct DeliverCode {
code: u32,
skip: Atomic<bool>,
+ pid: i32,
}
kernel::list::impl_list_arc_safe! {
@@ -228,10 +229,11 @@ struct DeliverCode {
}
impl DeliverCode {
- fn new(code: u32) -> Self {
+ fn new(code: u32, pid: i32) -> Self {
Self {
code,
skip: Atomic::new(false),
+ pid,
}
}
@@ -256,7 +258,15 @@ fn do_work(
Ok(true)
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ if !self.skip.load(Relaxed) {
+ binder_debug!(
+ pid = self.pid,
+ DeadTransaction,
+ "undelivered TRANSACTION_COMPLETE"
+ );
+ }
+ }
fn should_sync_wakeup(&self) -> bool {
false
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 26925d094a59..102413879d1d 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -279,7 +279,7 @@ struct InnerThread {
const LOOPER_POLL: u32 = 0x40;
impl InnerThread {
- fn new() -> Result<Self> {
+ fn new(pid: i32) -> Result<Self> {
fn next_err_id() -> u32 {
static EE_ID: Atomic<u32> = Atomic::new(0);
EE_ID.fetch_add(1, Relaxed)
@@ -290,8 +290,8 @@ fn next_err_id() -> u32 {
looper_need_return: false,
is_dead: false,
process_work_list: false,
- reply_work: ThreadError::try_new()?,
- return_work: ThreadError::try_new()?,
+ reply_work: ThreadError::try_new(pid)?,
+ return_work: ThreadError::try_new(pid)?,
work_list: List::new(),
current_transaction: None,
extended_error: ExtendedError::new(next_err_id(), BR_OK, 0),
@@ -445,7 +445,7 @@ impl ListItem<0> for Thread {
impl Thread {
pub(crate) fn new(id: i32, process: Arc<Process>) -> Result<Arc<Self>> {
- let inner = InnerThread::new()?;
+ let inner = InnerThread::new(process.task.pid())?;
Arc::pin_init(
try_pin_init!(Thread {
@@ -1108,6 +1108,12 @@ fn unwind_transaction_stack(self: &Arc<Self>) {
let mut inner = thread.inner.lock();
inner.pop_transaction_to_reply(thread.as_ref())
} {
+ binder_debug!(
+ DeadTransaction,
+ "release transaction {} in, still active",
+ transaction.debug_id
+ );
+
let reply = Err(BR_DEAD_REPLY);
if !transaction.from.deliver_single_reply(reply, &transaction) {
break;
@@ -1284,7 +1290,10 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
// TODO: We need to ensure that there isn't a pending transaction in the work queue. How
// could this happen?
let top = self.top_of_transaction_stack()?;
- let list_completion = DTRWrap::arc_try_new(DeliverCode::new(BR_TRANSACTION_COMPLETE))?;
+ let list_completion = DTRWrap::arc_try_new(DeliverCode::new(
+ BR_TRANSACTION_COMPLETE,
+ self.process.task.pid(),
+ ))?;
let completion = list_completion.clone_arc();
let transaction = Transaction::new(node_ref, top, self, info)?;
@@ -1336,7 +1345,10 @@ fn reply_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResult {
// We need to complete the transaction even if we cannot complete building the reply.
let out = (|| -> BinderResult<_> {
- let completion = DTRWrap::arc_try_new(DeliverCode::new(BR_TRANSACTION_COMPLETE))?;
+ let completion = DTRWrap::arc_try_new(DeliverCode::new(
+ BR_TRANSACTION_COMPLETE,
+ self.process.task.pid(),
+ ))?;
let process = orig.from.process.clone();
let allow_fds = orig.flags & TF_ACCEPT_FDS != 0;
let reply = Transaction::new_reply(self, process, info, allow_fds)?;
@@ -1370,7 +1382,8 @@ fn oneway_transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> Bin
} else {
BR_TRANSACTION_COMPLETE
};
- let list_completion = DTRWrap::arc_try_new(DeliverCode::new(code))?;
+ let list_completion =
+ DTRWrap::arc_try_new(DeliverCode::new(code, self.process.task.pid()))?;
let completion = list_completion.clone_arc();
self.inner.lock().push_work(list_completion);
match transaction.submit(info) {
@@ -1626,14 +1639,16 @@ pub(crate) fn release(self: &Arc<Self>) {
#[pin_data]
struct ThreadError {
error_code: Atomic<u32>,
+ pid: i32,
#[pin]
links_track: AtomicTracker,
}
impl ThreadError {
- fn try_new() -> Result<DArc<Self>> {
+ fn try_new(pid: i32) -> Result<DArc<Self>> {
DTRWrap::arc_pin_init(pin_init!(Self {
error_code: Atomic::new(BR_OK),
+ pid,
links_track <- AtomicTracker::new(),
}))
.map(ListArc::into_arc)
@@ -1660,7 +1675,16 @@ fn do_work(
Ok(true)
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ let code = self.error_code.load(Relaxed);
+ if code != BR_OK {
+ binder_debug!(
+ pid = self.pid,
+ DeadTransaction,
+ "undelivered TRANSACTION_ERROR: {code}"
+ );
+ }
+ }
fn should_sync_wakeup(&self) -> bool {
false
diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs
index b56dca55662d..0dbc7a9d16f9 100644
--- a/drivers/android/binder/transaction.rs
+++ b/drivers/android/binder/transaction.rs
@@ -489,6 +489,13 @@ fn cancel(self: DArc<Self>) {
if self.target_node.is_some() && self.flags & TF_ONE_WAY == 0 {
let reply = Err(BR_DEAD_REPLY);
self.from.deliver_reply(reply, &self);
+ } else {
+ binder_debug!(
+ pid = self.to.task.pid(),
+ DeadTransaction,
+ "undelivered transaction {}, process died",
+ self.debug_id
+ );
}
self.drop_outstanding_txn();
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* [PATCH v3 7/7] rust_binder: Implement BINDER_DEBUG_DEAD_TRANSACTION
@ 2026-07-13 12:35 ` Jahnavi MN via B4 Relay
0 siblings, 0 replies; 17+ messages in thread
From: Jahnavi MN via B4 Relay @ 2026-07-13 12:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Carlos Llamas, Alice Ryhl, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Andreas Hindborg, Trevor Gross, Danilo Krummrich, Daniel Almeida,
Tamir Duberstein, Alexandre Courbot, Onur Özkan
Cc: linux-kernel, rust-for-linux, Jahnavi MN
From: Jahnavi MN <jahnavimn@google.com>
This adds dynamic debug logs for:
- Releasing active transactions during thread stack unwinding.
- Discarded transaction error codes when a thread exits.
- Undelivered transaction acknowledgments (TRANSACTION_COMPLETE)
upon thread exit.
- Undelivered process death and freeze notifications when processes
exit or die.
- Undelivered transactions canceled due to target process death.
We now store the process PID in `ThreadError`, `DeliverCode`, and
`FreezeMessage` to ensure the correct PID is logged on cancellation.
This is necessary because `cancel()` runs from background `kworkers`,
which would otherwise print the wrong PID.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
---
drivers/android/binder/freeze.rs | 24 +++++++++++------
drivers/android/binder/node.rs | 9 ++++++-
drivers/android/binder/rust_binder_main.rs | 14 ++++++++--
drivers/android/binder/thread.rs | 42 +++++++++++++++++++++++-------
drivers/android/binder/transaction.rs | 7 +++++
5 files changed, 76 insertions(+), 20 deletions(-)
diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs
index 2c99e0995554..7b825ffba557 100644
--- a/drivers/android/binder/freeze.rs
+++ b/drivers/android/binder/freeze.rs
@@ -60,6 +60,7 @@ fn allow_duplicate(&self, node: &DArc<Node>) -> bool {
/// Represents a notification that the freeze state has changed.
pub(crate) struct FreezeMessage {
cookie: FreezeCookie,
+ pid: i32,
}
kernel::list::impl_list_arc_safe! {
@@ -73,8 +74,8 @@ fn new(flags: kernel::alloc::Flags) -> Result<UninitFM, AllocError> {
UniqueArc::new_uninit(flags)
}
- fn init(ua: UninitFM, cookie: FreezeCookie) -> DLArc<FreezeMessage> {
- match ua.pin_init_with(DTRWrap::new(FreezeMessage { cookie })) {
+ fn init(ua: UninitFM, cookie: FreezeCookie, pid: i32) -> DLArc<FreezeMessage> {
+ match ua.pin_init_with(DTRWrap::new(FreezeMessage { cookie, pid })) {
Ok(msg) => ListArc::from(msg),
Err(err) => match err {},
}
@@ -140,7 +141,14 @@ fn do_work(
}
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ binder_debug!(
+ pid = self.pid,
+ DeadTransaction,
+ "undelivered freeze notification, {:016x}",
+ self.cookie.0
+ );
+ }
fn should_sync_wakeup(&self) -> bool {
false
@@ -251,7 +259,7 @@ pub(crate) fn request_freeze_notif(
}
*info.freeze() = Some(cookie);
- let msg = FreezeMessage::init(msg, cookie);
+ let msg = FreezeMessage::init(msg, cookie, self.task.pid());
drop(node_refs_guard);
let _ = self.push_work(msg);
Ok(())
@@ -272,7 +280,7 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
};
let mut clear_msg = None;
if freeze.num_pending_duplicates > 0 {
- clear_msg = Some(FreezeMessage::init(alloc, cookie));
+ clear_msg = Some(FreezeMessage::init(alloc, cookie, self.task.pid()));
freeze.num_pending_duplicates -= 1;
freeze.num_cleared_duplicates += 1;
} else {
@@ -287,7 +295,7 @@ pub(crate) fn freeze_notif_done(self: &Arc<Self>, reader: &mut UserSliceReader)
let is_frozen = freeze.node.owner.inner.lock().is_frozen.is_fully_frozen();
if freeze.is_clearing || freeze.last_is_frozen != Some(is_frozen) {
// Immediately send another FreezeMessage.
- clear_msg = Some(FreezeMessage::init(alloc, cookie));
+ clear_msg = Some(FreezeMessage::init(alloc, cookie, self.task.pid()));
}
freeze.is_pending = false;
}
@@ -340,7 +348,7 @@ pub(crate) fn clear_freeze_notif(self: &Arc<Self>, reader: &mut UserSliceReader)
*info.freeze() = None;
let mut msg = None;
if !listener.is_pending {
- msg = Some(FreezeMessage::init(alloc, cookie));
+ msg = Some(FreezeMessage::init(alloc, cookie, self.task.pid()));
}
drop(node_refs_guard);
@@ -420,7 +428,7 @@ pub(crate) fn prepare_freeze_messages(&self) -> Result<FreezeMessages, AllocErro
continue;
};
let msg_alloc = FreezeMessage::new(GFP_KERNEL)?;
- let msg = FreezeMessage::init(msg_alloc, cookie);
+ let msg = FreezeMessage::init(msg_alloc, cookie, proc.task.pid());
batch.push((proc, msg), GFP_KERNEL)?;
}
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 87a2e613a816..b9e21b8ec251 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -1120,7 +1120,14 @@ fn do_work(
Ok(cmd != BR_DEAD_BINDER)
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ binder_debug!(
+ pid = self.process.task.pid(),
+ DeadTransaction,
+ "undelivered death notification, {:016x}",
+ self.cookie
+ );
+ }
fn should_sync_wakeup(&self) -> bool {
false
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 29829cb210a4..15c7b65928d8 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -221,6 +221,7 @@ fn arc_pin_init(init: impl PinInit<T>) -> Result<DLArc<T>, kernel::error::Error>
struct DeliverCode {
code: u32,
skip: Atomic<bool>,
+ pid: i32,
}
kernel::list::impl_list_arc_safe! {
@@ -228,10 +229,11 @@ struct DeliverCode {
}
impl DeliverCode {
- fn new(code: u32) -> Self {
+ fn new(code: u32, pid: i32) -> Self {
Self {
code,
skip: Atomic::new(false),
+ pid,
}
}
@@ -256,7 +258,15 @@ fn do_work(
Ok(true)
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ if !self.skip.load(Relaxed) {
+ binder_debug!(
+ pid = self.pid,
+ DeadTransaction,
+ "undelivered TRANSACTION_COMPLETE"
+ );
+ }
+ }
fn should_sync_wakeup(&self) -> bool {
false
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 26925d094a59..102413879d1d 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -279,7 +279,7 @@ struct InnerThread {
const LOOPER_POLL: u32 = 0x40;
impl InnerThread {
- fn new() -> Result<Self> {
+ fn new(pid: i32) -> Result<Self> {
fn next_err_id() -> u32 {
static EE_ID: Atomic<u32> = Atomic::new(0);
EE_ID.fetch_add(1, Relaxed)
@@ -290,8 +290,8 @@ fn next_err_id() -> u32 {
looper_need_return: false,
is_dead: false,
process_work_list: false,
- reply_work: ThreadError::try_new()?,
- return_work: ThreadError::try_new()?,
+ reply_work: ThreadError::try_new(pid)?,
+ return_work: ThreadError::try_new(pid)?,
work_list: List::new(),
current_transaction: None,
extended_error: ExtendedError::new(next_err_id(), BR_OK, 0),
@@ -445,7 +445,7 @@ impl ListItem<0> for Thread {
impl Thread {
pub(crate) fn new(id: i32, process: Arc<Process>) -> Result<Arc<Self>> {
- let inner = InnerThread::new()?;
+ let inner = InnerThread::new(process.task.pid())?;
Arc::pin_init(
try_pin_init!(Thread {
@@ -1108,6 +1108,12 @@ fn unwind_transaction_stack(self: &Arc<Self>) {
let mut inner = thread.inner.lock();
inner.pop_transaction_to_reply(thread.as_ref())
} {
+ binder_debug!(
+ DeadTransaction,
+ "release transaction {} in, still active",
+ transaction.debug_id
+ );
+
let reply = Err(BR_DEAD_REPLY);
if !transaction.from.deliver_single_reply(reply, &transaction) {
break;
@@ -1284,7 +1290,10 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
// TODO: We need to ensure that there isn't a pending transaction in the work queue. How
// could this happen?
let top = self.top_of_transaction_stack()?;
- let list_completion = DTRWrap::arc_try_new(DeliverCode::new(BR_TRANSACTION_COMPLETE))?;
+ let list_completion = DTRWrap::arc_try_new(DeliverCode::new(
+ BR_TRANSACTION_COMPLETE,
+ self.process.task.pid(),
+ ))?;
let completion = list_completion.clone_arc();
let transaction = Transaction::new(node_ref, top, self, info)?;
@@ -1336,7 +1345,10 @@ fn reply_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResult {
// We need to complete the transaction even if we cannot complete building the reply.
let out = (|| -> BinderResult<_> {
- let completion = DTRWrap::arc_try_new(DeliverCode::new(BR_TRANSACTION_COMPLETE))?;
+ let completion = DTRWrap::arc_try_new(DeliverCode::new(
+ BR_TRANSACTION_COMPLETE,
+ self.process.task.pid(),
+ ))?;
let process = orig.from.process.clone();
let allow_fds = orig.flags & TF_ACCEPT_FDS != 0;
let reply = Transaction::new_reply(self, process, info, allow_fds)?;
@@ -1370,7 +1382,8 @@ fn oneway_transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> Bin
} else {
BR_TRANSACTION_COMPLETE
};
- let list_completion = DTRWrap::arc_try_new(DeliverCode::new(code))?;
+ let list_completion =
+ DTRWrap::arc_try_new(DeliverCode::new(code, self.process.task.pid()))?;
let completion = list_completion.clone_arc();
self.inner.lock().push_work(list_completion);
match transaction.submit(info) {
@@ -1626,14 +1639,16 @@ pub(crate) fn release(self: &Arc<Self>) {
#[pin_data]
struct ThreadError {
error_code: Atomic<u32>,
+ pid: i32,
#[pin]
links_track: AtomicTracker,
}
impl ThreadError {
- fn try_new() -> Result<DArc<Self>> {
+ fn try_new(pid: i32) -> Result<DArc<Self>> {
DTRWrap::arc_pin_init(pin_init!(Self {
error_code: Atomic::new(BR_OK),
+ pid,
links_track <- AtomicTracker::new(),
}))
.map(ListArc::into_arc)
@@ -1660,7 +1675,16 @@ fn do_work(
Ok(true)
}
- fn cancel(self: DArc<Self>) {}
+ fn cancel(self: DArc<Self>) {
+ let code = self.error_code.load(Relaxed);
+ if code != BR_OK {
+ binder_debug!(
+ pid = self.pid,
+ DeadTransaction,
+ "undelivered TRANSACTION_ERROR: {code}"
+ );
+ }
+ }
fn should_sync_wakeup(&self) -> bool {
false
diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs
index b56dca55662d..0dbc7a9d16f9 100644
--- a/drivers/android/binder/transaction.rs
+++ b/drivers/android/binder/transaction.rs
@@ -489,6 +489,13 @@ fn cancel(self: DArc<Self>) {
if self.target_node.is_some() && self.flags & TF_ONE_WAY == 0 {
let reply = Err(BR_DEAD_REPLY);
self.from.deliver_reply(reply, &self);
+ } else {
+ binder_debug!(
+ pid = self.to.task.pid(),
+ DeadTransaction,
+ "undelivered transaction {}, process died",
+ self.debug_id
+ );
}
self.drop_outstanding_txn();
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related [flat|nested] 17+ messages in thread* Re: [PATCH v3 7/7] rust_binder: Implement BINDER_DEBUG_DEAD_TRANSACTION
2026-07-13 12:35 ` Jahnavi MN via B4 Relay
(?)
@ 2026-07-13 21:04 ` Carlos Llamas
-1 siblings, 0 replies; 17+ messages in thread
From: Carlos Llamas @ 2026-07-13 21:04 UTC (permalink / raw)
To: jahnavimn
Cc: Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos,
Christian Brauner, Alice Ryhl, Miguel Ojeda, Boqun Feng, Gary Guo,
Björn Roy Baron, Benno Lossin, Andreas Hindborg,
Trevor Gross, Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, linux-kernel, rust-for-linux
On Mon, Jul 13, 2026 at 12:35:29PM +0000, Jahnavi MN via B4 Relay wrote:
> From: Jahnavi MN <jahnavimn@google.com>
>
> This adds dynamic debug logs for:
> - Releasing active transactions during thread stack unwinding.
> - Discarded transaction error codes when a thread exits.
> - Undelivered transaction acknowledgments (TRANSACTION_COMPLETE)
> upon thread exit.
> - Undelivered process death and freeze notifications when processes
> exit or die.
> - Undelivered transactions canceled due to target process death.
>
> We now store the process PID in `ThreadError`, `DeliverCode`, and
> `FreezeMessage` to ensure the correct PID is logged on cancellation.
> This is necessary because `cancel()` runs from background `kworkers`,
> which would otherwise print the wrong PID.
>
> Reviewed-by: Alice Ryhl <aliceryhl@google.com>
> Signed-off-by: Jahnavi MN <jahnavimn@google.com>
> ---
Thanks Jahnavi,
Reviewed-by: Carlos Llamas <cmllamas@google.com>
^ permalink raw reply [flat|nested] 17+ messages in thread