[PATCH 4/6] binder: Remove mmap_lock fallback

Dave Hansen
2026-04-29T18:20:02Z

From: Dave Hansen <dave.hansen@linux.intel.com>

Previously, the per-VMA locking could fail in the face of writers
which necessitate a fallback to mmap_lock. The new
lock_vma_under_rcu_wait() will wait for writers instead of failing.

Use the new helper. Wait for writers. Remove the fallback to mmap_lock.

Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: linux-mm@kvack.org
---

b/drivers/android/binder_alloc.c | 17 +++++------------
1 file changed, 5 insertions(+), 12 deletions(-)

diff -puN drivers/android/binder_alloc.c~binder-vma-waiter drivers/android/binder_alloc.c
--- a/drivers/android/binder_alloc.c~binder-vma-waiter 2026-04-29 11:18:51.307654829 -0700
+++ b/drivers/android/binder_alloc.c 2026-04-29 11:18:51.310654944 -0700
@@ -259,21 +259,14 @@ static int binder_page_insert(struct bin
struct vm_area_struct *vma;
int ret = -ESRCH;

- /* attempt per-vma lock first */
- vma = lock_vma_under_rcu(mm, addr);
- if (vma) {
- if (binder_alloc_is_mapped(alloc))
- ret = vm_insert_page(vma, addr, page);
- vma_end_read(vma);
+ vma = lock_vma_under_rcu_wait(mm, addr);
+ if (!vma)
return ret;
- }

- /* fall back to mmap_lock */
- mmap_read_lock(mm);
- vma = vma_lookup(mm, addr);
- if (vma && binder_alloc_is_mapped(alloc))
+ if (binder_alloc_is_mapped(alloc))
ret = vm_insert_page(vma, addr, page);
- mmap_read_unlock(mm);
+
+ vma_end_read(vma);

return ret;
}
_