From 2812b20e165dbd9764d31d25686e305c7f329010 Mon Sep 17 00:00:00 2001 From: Alice Ryhl Date: Mon, 15 Jun 2026 12:36:44 +0000 Subject: [PATCH] rust_binder: keep NodeDeath in NodeRefInfo during process cleanup By keeping the NodeDeath inside the NodeRefInfo structure during process cleanup, we avoid running its destructor under the node_refs lock. It is still dropped shortly thereafter when the entire rbtree holding the NodeRefInfo objects is dropped, but that occurs outside of the lock. Reviewed-by: Matthew Maurer Signed-off-by: Alice Ryhl Link: https://patch.msgid.link/20260615-binder-noderefs-spin-v3-4-3235f5a3e0a0@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder/process.rs | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs index 7b214dc51586..7a45d478e33a 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1375,13 +1375,11 @@ fn deferred_release(self: Arc) { // SAFETY: We are removing the `NodeRefInfo` from the right node. unsafe { info.node_ref2().node.remove_node_info(info) }; - // Remove all death notifications from the nodes (that belong to a different process). - let death = if let Some(existing) = info.death().take() { - existing - } else { - continue; - }; - death.set_cleared(false); + // Clear death notifications from the nodes (that belong to a different process). + // No need to remove them from `info` as we clear info below. + if let Some(death) = info.death().as_ref() { + death.set_cleared(false); + } } // Clean up freeze listeners.