Patch "binder: fix unused alloc->free_async_space" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    binder: fix unused alloc->free_async_space

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     binder-fix-unused-alloc-free_async_space.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c3e0fbeec7805ff98e4dd74c5a3d38031269da1e
Author: Carlos Llamas <cmllamas@xxxxxxxxxx>
Date:   Fri Dec 1 17:21:34 2023 +0000

    binder: fix unused alloc->free_async_space
    
    [ Upstream commit c6d05e0762ab276102246d24affd1e116a46aa0c ]
    
    Each transaction is associated with a 'struct binder_buffer' that stores
    the metadata about its buffer area. Since commit 74310e06be4d ("android:
    binder: Move buffer out of area shared with user space") this struct is
    no longer embedded within the buffer itself but is instead allocated on
    the heap to prevent userspace access to this driver-exclusive info.
    
    Unfortunately, the space of this struct is still being accounted for in
    the total buffer size calculation, specifically for async transactions.
    This results in an additional 104 bytes added to every async buffer
    request, and this area is never used.
    
    This wasted space can be substantial. If we consider the maximum mmap
    buffer space of SZ_4M, the driver will reserve half of it for async
    transactions, or 0x200000. This area should, in theory, accommodate up
    to 262,144 buffers of the minimum 8-byte size. However, after adding
    the extra 'sizeof(struct binder_buffer)', the total number of buffers
    drops to only 18,724, which is a sad 7.14% of the actual capacity.
    
    This patch fixes the buffer size calculation to enable the utilization
    of the entire async buffer space. This is expected to reduce the number
    of -ENOSPC errors that are seen on the field.
    
    Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space")
    Signed-off-by: Carlos Llamas <cmllamas@xxxxxxxxxx>
    Reviewed-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@xxxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index ceb70543ca90..cfe8c61d14fc 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -360,8 +360,7 @@ static void debug_low_async_space_locked(struct binder_alloc *alloc, int pid)
 			continue;
 		if (!buffer->async_transaction)
 			continue;
-		total_alloc_size += binder_alloc_buffer_size(alloc, buffer)
-			+ sizeof(struct binder_buffer);
+		total_alloc_size += binder_alloc_buffer_size(alloc, buffer);
 		num_buffers++;
 	}