This is a note to let you know that I've just added the patch titled
binder: fix unused alloc->free_async_space
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
binder-fix-unused-alloc-free_async_space.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From c6d05e0762ab276102246d24affd1e116a46aa0c Mon Sep 17 00:00:00 2001
From: Carlos Llamas <cmllamas@xxxxxxxxxx>
Date: Fri, 1 Dec 2023 17:21:34 +0000
Subject: binder: fix unused alloc->free_async_space
From: Carlos Llamas <cmllamas@xxxxxxxxxx>
commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream.
Each transaction is associated with a 'struct binder_buffer' that stores
the metadata about its buffer area. Since commit 74310e06be4d ("android:
binder: Move buffer out of area shared with user space") this struct is
no longer embedded within the buffer itself but is instead allocated on
the heap to prevent userspace access to this driver-exclusive info.
Unfortunately, the space of this struct is still being accounted for in
the total buffer size calculation, specifically for async transactions.
This results in an additional 104 bytes added to every async buffer
request, and this area is never used.
This wasted space can be substantial. If we consider the maximum mmap
buffer space of SZ_4M, the driver will reserve half of it for async
transactions, or 0x200000. This area should, in theory, accommodate up
to 262,144 buffers of the minimum 8-byte size. However, after adding
the extra 'sizeof(struct binder_buffer)', the total number of buffers
drops to only 18,724, which is a sad 7.14% of the actual capacity.
This patch fixes the buffer size calculation to enable the utilization
of the entire async buffer space. This is expected to reduce the number
of -ENOSPC errors that are seen on the field.
Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Carlos Llamas <cmllamas@xxxxxxxxxx>
Reviewed-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@xxxxxxxxxx
[cmllamas: fix trivial conflict with missing 261e7818f06e.]
Signed-off-by: Carlos Llamas <cmllamas@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/android/binder_alloc.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -382,8 +382,7 @@ static struct binder_buffer *binder_allo
/* Pad 0-size buffers so they get assigned unique addresses */
size = max(size, sizeof(void *));
- if (is_async &&
- alloc->free_async_space < size + sizeof(struct binder_buffer)) {
+ if (is_async && alloc->free_async_space < size) {
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
"%d: binder_alloc_buf size %zd failed, no async space left\n",
alloc->pid, size);
@@ -489,7 +488,7 @@ static struct binder_buffer *binder_allo
buffer->async_transaction = is_async;
buffer->extra_buffers_size = extra_buffers_size;
if (is_async) {
- alloc->free_async_space -= size + sizeof(struct binder_buffer);
+ alloc->free_async_space -= size;
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
"%d: binder_alloc_buf size %zd async free %zd\n",
alloc->pid, size, alloc->free_async_space);
@@ -614,8 +613,7 @@ static void binder_free_buf_locked(struc
BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size);
if (buffer->async_transaction) {
- alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
-
+ alloc->free_async_space += buffer_size;
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
"%d: binder_free_buf size %zd async free %zd\n",
alloc->pid, size, alloc->free_async_space);
Patches currently in stable-queue which might be from cmllamas@xxxxxxxxxx are
queue-5.4/binder-use-epollerr-from-eventpoll.h.patch
queue-5.4/binder-fix-race-between-mmput-and-do_exit.patch
queue-5.4/binder-fix-async-space-check-for-0-sized-buffers.patch
queue-5.4/binder-fix-comment-on-binder_alloc_new_buf-return-value.patch
queue-5.4/binder-fix-trivial-typo-of-binder_free_buf_locked.patch
queue-5.4/binder-fix-use-after-free-in-shinker-s-callback.patch
queue-5.4/binder-fix-unused-alloc-free_async_space.patch
