tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

rust_binder: use AssertSync for BINDER_VM_OPS

When declaring an immutable global variable in Rust, the compiler checks
that it looks thread safe, because it is generally safe to access said
global variable. When using C bindings types for these globals, we don't
really want this check, because it is conservative and assumes pointers
are not thread safe.

In the case of BINDER_VM_OPS, this is a challenge when combined with the
patch 'userfaultfd: introduce vm_uffd_ops' [1], which introduces a
pointer field to vm_operations_struct. It previously only held function
pointers, which are considered thread safe.

Rust Binder should not be assuming that vm_operations_struct contains no
pointer fields, so to fix this, use AssertSync (which Rust Binder has
already declared for another similar global of type struct
file_operations with the same problem). This ensures that even if
another commit adds a pointer field to vm_operations_struct, this does
not cause problems.

Fixes: 8ef2c15aeae0 ("rust_binder: check ownership before using vma")
Cc: stable <stable@kernel.org>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202603121235.tpnRxFKO-lkp@intel.com/
Link: https://lore.kernel.org/r/20260306171815.3160826-8-rppt@kernel.org [1]
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260314111951.4139029-1-aliceryhl@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Alice Ryhl and committed by
Greg Kroah-Hartman ec327aba 80ffc54d

+6 -4
+5 -3
drivers/android/binder/page_range.rs
··· 13 13 // 14 14 // The shrinker will use trylock methods because it locks them in a different order. 15 15 16 + use crate::AssertSync; 17 + 16 18 use core::{ 17 19 marker::PhantomPinned, 18 20 mem::{size_of, size_of_val, MaybeUninit}, ··· 145 143 } 146 144 147 145 // We do not define any ops. For now, used only to check identity of vmas. 148 - static BINDER_VM_OPS: bindings::vm_operations_struct = pin_init::zeroed(); 146 + static BINDER_VM_OPS: AssertSync<bindings::vm_operations_struct> = AssertSync(pin_init::zeroed()); 149 147 150 148 // To ensure that we do not accidentally install pages into or zap pages from the wrong vma, we 151 149 // check its vm_ops and private data before using it. 152 150 fn check_vma(vma: &virt::VmaRef, owner: *const ShrinkablePageRange) -> Option<&virt::VmaMixedMap> { 153 151 // SAFETY: Just reading the vm_ops pointer of any active vma is safe. 154 152 let vm_ops = unsafe { (*vma.as_ptr()).vm_ops }; 155 - if !ptr::eq(vm_ops, &BINDER_VM_OPS) { 153 + if !ptr::eq(vm_ops, &BINDER_VM_OPS.0) { 156 154 return None; 157 155 } 158 156 ··· 344 342 345 343 // SAFETY: We own the vma, and we don't use any methods on VmaNew that rely on 346 344 // `vm_ops`. 347 - unsafe { (*vma.as_ptr()).vm_ops = &BINDER_VM_OPS }; 345 + unsafe { (*vma.as_ptr()).vm_ops = &BINDER_VM_OPS.0 }; 348 346 349 347 Ok(num_pages) 350 348 }
+1 -1
drivers/android/binder/rust_binder_main.rs
··· 306 306 /// Makes the inner type Sync. 307 307 #[repr(transparent)] 308 308 pub struct AssertSync<T>(T); 309 - // SAFETY: Used only to insert `file_operations` into a global, which is safe. 309 + // SAFETY: Used only to insert C bindings types into globals, which is safe. 310 310 unsafe impl<T> Sync for AssertSync<T> {} 311 311 312 312 /// File operations that rust_binderfs.c can use.