[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJuCfpG=zMHGGEw36dPHQs08iHmzNi5Ze5Rwcr85RqavsHP=cw@mail.gmail.com>
Date: Thu, 7 Nov 2024 07:33:13 -0800
From: Suren Baghdasaryan <surenb@...gle.com>
To: Carlos Llamas <cmllamas@...gle.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Arve Hjønnevåg <arve@...roid.com>,
Todd Kjos <tkjos@...roid.com>, Martijn Coenen <maco@...roid.com>,
Joel Fernandes <joel@...lfernandes.org>, Christian Brauner <brauner@...nel.org>,
linux-kernel@...r.kernel.org, kernel-team@...roid.com,
Minchan Kim <minchan@...nel.org>, "Liam R. Howlett" <Liam.Howlett@...cle.com>,
Matthew Wilcox <willy@...radead.org>
Subject: Re: [PATCH v2 6/8] binder: remove cached alloc->vma pointer
On Wed, Nov 6, 2024 at 8:03 PM Carlos Llamas <cmllamas@...gle.com> wrote:
>
> All usage of the alloc->vma pointer has been removed from binder.
> Instead, paths has been refactored to use either vma_lookup() or the
> alloc->mapped state. Using the alloc->vma was unsafe and required the
> mmap_sem in exclusive mode, which caused several performance and
> security issues in the past.
nit: I think this can be safely squashed with the previous patch and
call it a replacement.
>
> Cc: Minchan Kim <minchan@...nel.org>
> Cc: Liam R. Howlett <Liam.Howlett@...cle.com>
> Cc: Matthew Wilcox <willy@...radead.org>
> Cc: Suren Baghdasaryan <surenb@...gle.com>
> Signed-off-by: Carlos Llamas <cmllamas@...gle.com>
> ---
> drivers/android/binder_alloc.c | 14 --------------
> drivers/android/binder_alloc.h | 3 ---
> 2 files changed, 17 deletions(-)
>
> diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
> index 7239b92ef20a..13b476cc5b62 100644
> --- a/drivers/android/binder_alloc.c
> +++ b/drivers/android/binder_alloc.c
> @@ -377,20 +377,6 @@ static void binder_lru_freelist_del(struct binder_alloc *alloc,
> }
> }
>
> -static inline void binder_alloc_set_vma(struct binder_alloc *alloc,
> - struct vm_area_struct *vma)
> -{
> - /* pairs with smp_load_acquire in binder_alloc_get_vma() */
> - smp_store_release(&alloc->vma, vma);
> -}
> -
> -static inline struct vm_area_struct *binder_alloc_get_vma(
> - struct binder_alloc *alloc)
> -{
> - /* pairs with smp_store_release in binder_alloc_set_vma() */
> - return smp_load_acquire(&alloc->vma);
> -}
> -
> static void debug_no_space_locked(struct binder_alloc *alloc)
> {
> size_t largest_alloc_size = 0;
> diff --git a/drivers/android/binder_alloc.h b/drivers/android/binder_alloc.h
> index 89f6fa25c670..b9e2e9dc90b3 100644
> --- a/drivers/android/binder_alloc.h
> +++ b/drivers/android/binder_alloc.h
> @@ -61,8 +61,6 @@ struct binder_buffer {
> /**
> * struct binder_alloc - per-binder proc state for binder allocator
> * @mutex: protects binder_alloc fields
> - * @vma: vm_area_struct passed to mmap_handler
> - * (invariant after mmap)
> * @mm: copy of task->mm (invariant after open)
> * @buffer: base of per-proc address space mapped via mmap
> * @buffers: list of all buffers for this proc
> @@ -86,7 +84,6 @@ struct binder_buffer {
> */
> struct binder_alloc {
> struct mutex mutex;
> - struct vm_area_struct *vma;
> struct mm_struct *mm;
> unsigned long buffer;
> struct list_head buffers;
> --
> 2.47.0.199.ga7371fff76-goog
>
Powered by blists - more mailing lists