linux-next: manual merge of the char-misc tree with the origin tree

linux-next: manual merge of the char-misc tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 16109 bytes --]

Hi all,

Today's linux-next merge of the char-misc tree got conflicts in:

  drivers/android/binder/node.rs
  drivers/android/binder/process.rs

between commits:

  6849cabfd30fb ("rust_binder: reject context manager self-transaction")
  bc4a982889787 ("rust_binder: clear freeze listener on node removal")

from the origin tree and commits:

  b9d17aa74ddd7 ("rust_binder: avoid allocating under node_refs for freeze listeners")
  521eae8326a18 ("rust_binder: avoid dropping NodeRef in update_ref() under lock")

from the char-misc tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

I am really not at all confident in this merge.

diff --combined drivers/android/binder/node.rs
index c10148e9069f3,fb57c0b20888f..0000000000000
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@@ -9,6 -9,7 +9,7 @@@ use kernel::
      seq_print,
      sync::lock::{spinlock::SpinLockBackend, Guard},
      sync::{Arc, LockedBy, SpinLock},
+     uapi,
  };
  
  use crate::{
@@@ -21,6 -22,7 +22,7 @@@
  };
  
  use core::mem;
+ use core::ptr;
  
  mod wrapper;
  pub(crate) use self::wrapper::CritIncrWrapper;
@@@ -321,7 -323,7 +323,7 @@@ impl Node 
      /// An id that is unique across all binder nodes on the system. Used as the key in the
      /// `by_node` map.
      pub(crate) fn global_id(&self) -> usize {
-         self as *const Node as usize
+         ptr::from_ref(self).addr()
      }
  
      pub(crate) fn get_id(&self) -> (u64, u64) {
@@@ -464,7 -466,7 +466,7 @@@
          owner_inner: &mut ProcessInner,
      ) -> Option<DLArc<dyn DeliverToRead>> {
          match self.incr_refcount_allow_zero2one(strong, owner_inner) {
-             Ok(Some(node)) => Some(node as _),
+             Ok(Some(node)) => Some(node as DLArc<dyn DeliverToRead>),
              Ok(None) => None,
              Err(CouldNotDeliverCriticalIncrement) => {
                  assert!(strong);
@@@ -489,8 -491,8 +491,8 @@@
          guard: &Guard<'_, ProcessInner, SpinLockBackend>,
      ) {
          let inner = self.inner.access(guard);
-         out.strong_count = inner.strong.count as _;
-         out.weak_count = inner.weak.count as _;
+         out.strong_count = inner.strong.count as u32;
+         out.weak_count = inner.weak.count as u32;
      }
  
      pub(crate) fn populate_debug_info(
@@@ -498,8 -500,8 +500,8 @@@
          out: &mut BinderNodeDebugInfo,
          guard: &Guard<'_, ProcessInner, SpinLockBackend>,
      ) {
-         out.ptr = self.ptr as _;
-         out.cookie = self.cookie as _;
+         out.ptr = self.ptr as uapi::binder_uintptr_t;
+         out.cookie = self.cookie as uapi::binder_uintptr_t;
          let inner = self.inner.access(guard);
          if inner.strong.has_count {
              out.has_strong_ref = 1;
@@@ -657,44 -659,41 +659,43 @@@
      pub(crate) fn add_freeze_listener(
          &self,
          process: &Arc<Process>,
-         flags: kernel::alloc::Flags,
-     ) -> Result {
-         let mut vec_alloc = KVVec::<Arc<Process>>::new();
-         loop {
-             let mut guard = self.owner.inner.lock();
-             // Do not check for `guard.dead`. The `dead` flag that matters here is the owner of the
-             // listener, no the target.
-             let inner = self.inner.access_mut(&mut guard);
-             let len = inner.freeze_list.len();
-             if len >= inner.freeze_list.capacity() {
-                 if len >= vec_alloc.capacity() {
-                     drop(guard);
-                     vec_alloc = KVVec::with_capacity((1 + len).next_power_of_two(), flags)?;
-                     continue;
-                 }
-                 mem::swap(&mut inner.freeze_list, &mut vec_alloc);
-                 for elem in vec_alloc.drain_all() {
-                     inner.freeze_list.push_within_capacity(elem)?;
-                 }
+         // If the vector needs to be resized, it's done via this argument.
+         vec_alloc: &mut KVVec<Arc<Process>>,
+     ) -> Result<Result<(), usize>> {
+         let mut guard = self.owner.inner.lock();
+         // Do not check for `guard.dead`. The `dead` flag that matters here is the owner of the
+         // listener, not the target.
+         let inner = self.inner.access_mut(&mut guard);
+         let len = inner.freeze_list.len();
+         if len == inner.freeze_list.capacity() {
+             if len >= vec_alloc.capacity() {
+                 // Request the caller to reallocate.
+                 return Ok(Err((1 + len).next_power_of_two()));
+             }
+             mem::swap(&mut inner.freeze_list, vec_alloc);
+             for elem in vec_alloc.drain_all() {
+                 inner.freeze_list.push_within_capacity(elem)?;
              }
-             inner.freeze_list.push_within_capacity(process.clone())?;
-             return Ok(());
          }
+         inner.freeze_list.push_within_capacity(process.clone())?;
+         Ok(Ok(()))
      }
  
 -    pub(crate) fn remove_freeze_listener(&self, p: &Arc<Process>) -> KVVec<Arc<Process>> {
 +    pub(crate) fn remove_freeze_listener(&self, p: &Process) -> KVVec<Arc<Process>> {
          let mut guard = self.owner.inner.lock();
          let inner = self.inner.access_mut(&mut guard);
          let len = inner.freeze_list.len();
 -        inner.freeze_list.retain(|proc| !Arc::ptr_eq(proc, p));
 +        inner
 +            .freeze_list
 +            .retain(|proc| !core::ptr::eq::<Process>(&**proc, p));
          if len == inner.freeze_list.len() {
              pr_warn!(
                  "Could not remove freeze listener for {}\n",
                  p.pid_in_current_ns()
              );
          }
+         // If the vector is empty it needs to be freed. However, we can't free it here because that
+         // might sleep, so return it to the caller.
          if inner.freeze_list.is_empty() {
              return mem::take(&mut inner.freeze_list);
          }
diff --combined drivers/android/binder/process.rs
index cdd1a90797266,1abeb83684e41..0000000000000
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@@ -30,9 -30,9 +30,9 @@@ use kernel::
      sync::{
          aref::ARef,
          lock::{spinlock::SpinLockBackend, Guard},
-         Arc, ArcBorrow, CondVar, CondVarTimeoutResult, Mutex, SpinLock, UniqueArc,
+         Arc, ArcBorrow, CondVar, CondVarTimeoutResult, SpinLock, UniqueArc,
      },
-     task::Task,
+     task::{Pid, Task},
      uaccess::{UserSlice, UserSliceReader},
      uapi,
      workqueue::{self, Work},
@@@ -259,7 -259,7 +259,7 @@@ impl ProcessInner 
          let push = match wrapper {
              None => node
                  .incr_refcount_allow_zero2one(strong, self)?
-                 .map(|node| node as _),
+                 .map(|node| node as DLArc<dyn DeliverToRead>),
              Some(wrapper) => node.incr_refcount_allow_zero2one_with_wrapper(strong, wrapper, self),
          };
          if let Some(node) = push {
@@@ -455,7 -455,7 +455,7 @@@ pub(crate) struct Process 
      // Node references are in a different lock to avoid recursive acquisition when
      // incrementing/decrementing a node in another process.
      #[pin]
-     node_refs: Mutex<ProcessNodeRefs>,
+     node_refs: SpinLock<ProcessNodeRefs>,
  
      // Work node for deferred work item.
      #[pin]
@@@ -510,7 -510,7 +510,7 @@@ impl Process 
                  cred,
                  inner <- kernel::new_spinlock!(ProcessInner::new(), "Process::inner"),
                  pages <- ShrinkablePageRange::new(&super::BINDER_SHRINKER),
-                 node_refs <- kernel::new_mutex!(ProcessNodeRefs::new(), "Process::node_refs"),
+                 node_refs <- kernel::new_spinlock!(ProcessNodeRefs::new(), "Process::node_refs"),
                  freeze_wait <- kernel::new_condvar!("Process::freeze_wait"),
                  task: current.group_leader().into(),
                  defer_work <- kernel::new_work!("Process::defer_work"),
@@@ -741,7 -741,7 +741,7 @@@
          } else {
              (0, 0, 0)
          };
-         let node_ref = self.get_node(ptr, cookie, flags as _, true, thread)?;
+         let node_ref = self.get_node(ptr, cookie, flags, true, thread)?;
          let node = node_ref.node.clone();
          self.ctx.set_manager_node(node_ref)?;
          self.inner.lock().is_manager = true;
@@@ -861,14 -861,17 +861,17 @@@
          let handle = unused_id.as_u32();
  
          // Do a lookup again as node may have been inserted before the lock was reacquired.
-         if let Some(handle_ref) = refs.by_node.get(&node_ref.node.global_id()) {
-             let handle = *handle_ref;
-             let info = refs.by_handle.get_mut(&handle).unwrap();
-             info.node_ref().absorb(node_ref);
-             return Ok(handle);
-         }
+         let by_node_slot = match refs.by_node.entry(node_ref.node.global_id()) {
+             rbtree::Entry::Vacant(by_node_slot) => by_node_slot,
+             rbtree::Entry::Occupied(handle_ref) => {
+                 // The node was inserted by another thread while we didn't hold the lock.
+                 let handle = handle_ref.get();
+                 let info = refs.by_handle.get_mut(handle).unwrap();
+                 info.node_ref().absorb(node_ref);
+                 return Ok(*handle);
+             }
+         };
  
-         let gid = node_ref.node.global_id();
          let (info_proc, info_node) = {
              let info_init = NodeRefInfo::new(node_ref, handle, self.into());
              match info.pin_init_with(info_init) {
@@@ -884,6 -887,9 +887,9 @@@
          // first thing in `deferred_release`, process cleanup will not miss the items inserted into
          // `refs` below.
          if self.inner.lock().is_dead {
+             // Explicitly drop the lock so that `info_proc` and `info_node` are dropped outside of
+             // the lock.
+             drop(refs_lock);
              return Err(ESRCH);
          }
  
@@@ -891,7 -897,7 +897,7 @@@
          // `info_node` into the right node's `refs` list.
          unsafe { info_proc.node_ref2().node.insert_node_info(info_node) };
  
-         refs.by_node.insert(reserve1.into_node(gid, handle));
+         by_node_slot.insert(handle, reserve1);
          by_handle_slot.insert(info_proc, reserve2);
          unused_id.acquire();
          Ok(handle)
@@@ -900,11 -906,7 +906,11 @@@
      pub(crate) fn get_transaction_node(&self, handle: u32) -> BinderResult<NodeRef> {
          // When handle is zero, try to get the context manager.
          if handle == 0 {
 -            Ok(self.ctx.get_manager_node(true)?)
 +            let node_ref = self.ctx.get_manager_node(true)?;
 +            if core::ptr::eq(self, &*node_ref.node.owner) {
 +                return Err(EINVAL.into());
 +            }
 +            Ok(node_ref)
          } else {
              Ok(self.get_node_from_handle(handle, true)?)
          }
@@@ -946,15 -948,17 +952,17 @@@
  
          // To preserve original binder behaviour, we only fail requests where the manager tries to
          // increment references on itself.
-         let _to_free_freeze_listener;
-         let _to_free_freeze_listener_cleanup;
+         let _to_free_by_handle;
+         let _to_free_by_node;
          let mut refs = self.node_refs.lock();
          if let Some(info) = refs.by_handle.get_mut(&handle) {
              if info.node_ref().update(inc, strong) {
                  // Clean up death if there is one attached to this node reference.
-                 if let Some(death) = info.death().take() {
+                 //
+                 // We remove the entire `info` below, so no need to remove `death` from `info`.
+                 if let Some(death) = info.death().as_ref() {
                      death.set_cleared(true);
-                     self.remove_from_delivered_deaths(&death);
+                     self.remove_from_delivered_deaths(death);
                  }
  
                  // Remove reference from process tables, and from the node's `refs` list.
@@@ -963,16 -967,8 +971,8 @@@
                  unsafe { info.node_ref2().node.remove_node_info(info) };
  
                  let id = info.node_ref().node.global_id();
- 
-                 if let Some(freeze) = *info.freeze() {
-                     if let Some(fl) = refs.freeze_listeners.remove(&freeze) {
-                         _to_free_freeze_listener_cleanup = fl.on_process_cleanup(&self);
-                         _to_free_freeze_listener = fl;
-                     }
-                 }
- 
-                 refs.by_handle.remove(&handle);
-                 refs.by_node.remove(&id);
+                 _to_free_by_handle = refs.by_handle.remove_node(&handle);
+                 _to_free_by_node = refs.by_node.remove_node(&id);
                  refs.handle_is_present.release_id(handle as usize);
  
                  if let Some(shrink) = refs.handle_is_present.shrink_request() {
@@@ -1299,7 -1295,10 +1299,10 @@@
  
          // Update state and determine if we need to queue a work item. We only need to do it when
          // the node is not dead or if the user already completed the death notification.
-         if death.set_cleared(false) {
+         let should_schedule = death.set_cleared(false);
+         drop(refs);
+ 
+         if should_schedule {
              if let Some(death) = ListArc::try_from_arc_or_drop(death) {
                  let _ = thread.push_work_if_looper(death);
              }
@@@ -1382,19 -1381,17 +1385,17 @@@
              // SAFETY: We are removing the `NodeRefInfo` from the right node.
              unsafe { info.node_ref2().node.remove_node_info(info) };
  
-             // Remove all death notifications from the nodes (that belong to a different process).
-             let death = if let Some(existing) = info.death().take() {
-                 existing
-             } else {
-                 continue;
-             };
-             death.set_cleared(false);
+             // Clear death notifications from the nodes (that belong to a different process).
+             // No need to remove them from `info` as we clear info below.
+             if let Some(death) = info.death().as_ref() {
+                 death.set_cleared(false);
+             }
          }
  
          // Clean up freeze listeners.
          let freeze_listeners = take(&mut self.node_refs.lock().freeze_listeners);
          for listener in freeze_listeners.values() {
 -            listener.on_process_exit(&self);
 +            listener.on_process_cleanup(&self);
          }
          drop(freeze_listeners);
  
@@@ -1536,13 -1533,13 +1537,13 @@@ fn get_frozen_status(data: UserSlice) -
  
      for ctx in crate::context::get_all_contexts()? {
          ctx.for_each_proc(|proc| {
-             if proc.task.pid() == info.pid as _ {
+             if proc.task.pid() == info.pid as Pid {
                  found = true;
                  let inner = proc.inner.lock();
                  let txns_pending = inner.txns_pending_locked();
-                 info.async_recv |= inner.async_recv as u32;
-                 info.sync_recv |= inner.sync_recv as u32;
-                 info.sync_recv |= (txns_pending as u32) << 1;
+                 info.async_recv |= u32::from(inner.async_recv);
+                 info.sync_recv |= u32::from(inner.sync_recv);
+                 info.sync_recv |= u32::from(txns_pending) << 1;
              }
          });
      }

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the char-misc tree with the origin tree

[Alice Ryhl]

On Mon, Jul 13, 2026 at 03:08:06PM +0100, Mark Brown wrote:
> Hi all,
> 
> Today's linux-next merge of the char-misc tree got conflicts in:
> 
>   drivers/android/binder/node.rs
>   drivers/android/binder/process.rs
> 
> between commits:
> 
>   6849cabfd30fb ("rust_binder: reject context manager self-transaction")
>   bc4a982889787 ("rust_binder: clear freeze listener on node removal")
> 
> from the origin tree and commits:
> 
>   b9d17aa74ddd7 ("rust_binder: avoid allocating under node_refs for freeze listeners")
>   521eae8326a18 ("rust_binder: avoid dropping NodeRef in update_ref() under lock")
> 
> from the char-misc tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 
> I am really not at all confident in this merge.

Thanks for giving it a shot! I have a slightly different resolution
since some lines added by commit bc4a98288978 ("rust_binder: clear
freeze listener on node removal") need to be kept.

Please see below for the diff between my resolution and yours.

Alice



$ git diff linux-next/master drivers/android/binder
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index c5f745c85a02..0555c4bd503e 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -954,6 +954,8 @@ pub(crate) fn update_ref(
         // increment references on itself.
         let _to_free_by_handle;
         let _to_free_by_node;
+        let _to_free_freeze_listener;
+        let _to_free_freeze_listener_cleanup;
         let mut refs = self.node_refs.lock();
         if let Some(info) = refs.by_handle.get_mut(&handle) {
             if info.node_ref().update(inc, strong) {
@@ -971,6 +973,14 @@ pub(crate) fn update_ref(
                 unsafe { info.node_ref2().node.remove_node_info(info) };
 
                 let id = info.node_ref().node.global_id();
+
+                if let Some(freeze) = *info.freeze() {
+                    if let Some(fl) = refs.freeze_listeners.remove(&freeze) {
+                        _to_free_freeze_listener_cleanup = fl.on_process_cleanup(&self);
+                        _to_free_freeze_listener = fl;
+                    }
+                }
+
                 _to_free_by_handle = refs.by_handle.remove_node(&handle);
                 _to_free_by_node = refs.by_node.remove_node(&id);
                 refs.handle_is_present.release_id(handle as usize);

Re: linux-next: manual merge of the char-misc tree with the origin tree

[Greg KH]

On Tue, Jul 14, 2026 at 12:46:41PM +0000, Alice Ryhl wrote:
> On Mon, Jul 13, 2026 at 03:08:06PM +0100, Mark Brown wrote:
> > Hi all,
> > 
> > Today's linux-next merge of the char-misc tree got conflicts in:
> > 
> >   drivers/android/binder/node.rs
> >   drivers/android/binder/process.rs
> > 
> > between commits:
> > 
> >   6849cabfd30fb ("rust_binder: reject context manager self-transaction")
> >   bc4a982889787 ("rust_binder: clear freeze listener on node removal")
> > 
> > from the origin tree and commits:
> > 
> >   b9d17aa74ddd7 ("rust_binder: avoid allocating under node_refs for freeze listeners")
> >   521eae8326a18 ("rust_binder: avoid dropping NodeRef in update_ref() under lock")
> > 
> > from the char-misc tree.
> > 
> > I fixed it up (see below) and can carry the fix as necessary. This
> > is now fixed as far as linux-next is concerned, but any non trivial
> > conflicts should be mentioned to your upstream maintainer when your tree
> > is submitted for merging.  You may also want to consider cooperating
> > with the maintainer of the conflicting tree to minimise any particularly
> > complex conflicts.
> > 
> > I am really not at all confident in this merge.
> 
> Thanks for giving it a shot! I have a slightly different resolution
> since some lines added by commit bc4a98288978 ("rust_binder: clear
> freeze listener on node removal") need to be kept.
> 
> Please see below for the diff between my resolution and yours.
> 
> Alice
> 
> 
> 
> $ git diff linux-next/master drivers/android/binder
> diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
> index c5f745c85a02..0555c4bd503e 100644
> --- a/drivers/android/binder/process.rs
> +++ b/drivers/android/binder/process.rs
> @@ -954,6 +954,8 @@ pub(crate) fn update_ref(
>          // increment references on itself.
>          let _to_free_by_handle;
>          let _to_free_by_node;
> +        let _to_free_freeze_listener;
> +        let _to_free_freeze_listener_cleanup;
>          let mut refs = self.node_refs.lock();
>          if let Some(info) = refs.by_handle.get_mut(&handle) {
>              if info.node_ref().update(inc, strong) {
> @@ -971,6 +973,14 @@ pub(crate) fn update_ref(
>                  unsafe { info.node_ref2().node.remove_node_info(info) };
>  
>                  let id = info.node_ref().node.global_id();
> +
> +                if let Some(freeze) = *info.freeze() {
> +                    if let Some(fl) = refs.freeze_listeners.remove(&freeze) {
> +                        _to_free_freeze_listener_cleanup = fl.on_process_cleanup(&self);
> +                        _to_free_freeze_listener = fl;
> +                    }
> +                }
> +
>                  _to_free_by_handle = refs.by_handle.remove_node(&handle);
>                  _to_free_by_node = refs.by_node.remove_node(&id);
>                  refs.handle_is_present.release_id(handle as usize);
> 


That's a diff between the two, can someone provide me with the diff I
should make now to the tree when I merge these branches together?

thanks,

greg k-h

Re: linux-next: manual merge of the char-misc tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 313 bytes --]

On Tue, Jul 14, 2026 at 02:55:14PM +0200, Greg KH wrote:

> That's a diff between the two, can someone provide me with the diff I
> should make now to the tree when I merge these branches together?

The resolution in -next today (when it's published, hopefully not too
long) should have integrated Alice's patch.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the char-misc tree with the origin tree

[Greg KH]

On Tue, Jul 14, 2026 at 03:19:41PM +0100, Mark Brown wrote:
> On Tue, Jul 14, 2026 at 02:55:14PM +0200, Greg KH wrote:
> 
> > That's a diff between the two, can someone provide me with the diff I
> > should make now to the tree when I merge these branches together?
> 
> The resolution in -next today (when it's published, hopefully not too
> long) should have integrated Alice's patch.

Cool, I'll copy that, thanks!

Re: linux-next: manual merge of the char-misc tree with the origin tree

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 296 bytes --]

On Tue, Jul 14, 2026 at 04:22:30PM +0200, Greg KH wrote:
> On Tue, Jul 14, 2026 at 03:19:41PM +0100, Mark Brown wrote:

> > The resolution in -next today (when it's published, hopefully not too
> > long) should have integrated Alice's patch.

> Cool, I'll copy that, thanks!

Just pushed it out.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: linux-next: manual merge of the char-misc tree with the origin tree

[Greg KH]

On Tue, Jul 14, 2026 at 04:06:00PM +0100, Mark Brown wrote:
> On Tue, Jul 14, 2026 at 04:22:30PM +0200, Greg KH wrote:
> > On Tue, Jul 14, 2026 at 03:19:41PM +0100, Mark Brown wrote:
> 
> > > The resolution in -next today (when it's published, hopefully not too
> > > long) should have integrated Alice's patch.
> 
> > Cool, I'll copy that, thanks!
> 
> Just pushed it out.

Great, I've taken your resolution.  Alice, if I messed anything up,
please let me know.

thanks,

greg k-h