rust_binder: keep NodeDeath in NodeRefInfo during process cleanup

By keeping the NodeDeath inside the NodeRefInfo structure during process
cleanup, we avoid running its destructor under the node_refs lock. It is
still dropped shortly thereafter when the entire rbtree holding the
NodeRefInfo objects is dropped, but that occurs outside of the lock.

Reviewed-by: Matthew Maurer <mmaurer@google.com>
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260615-binder-noderefs-spin-v3-4-3235f5a3e0a0@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alice Ryhl 2026-06-15 12:36:44 +00:00 committed by Greg Kroah-Hartman
parent 56c650167e
commit 2812b20e16

View File

@ -1375,13 +1375,11 @@ fn deferred_release(self: Arc<Self>) {
// SAFETY: We are removing the `NodeRefInfo` from the right node.
unsafe { info.node_ref2().node.remove_node_info(info) };
// Remove all death notifications from the nodes (that belong to a different process).
let death = if let Some(existing) = info.death().take() {
existing
} else {
continue;
};
death.set_cleared(false);
// Clear death notifications from the nodes (that belong to a different process).
// No need to remove them from `info` as we clear info below.
if let Some(death) = info.death().as_ref() {
death.set_cleared(false);
}
}
// Clean up freeze listeners.