github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rust_binder: use KVVec for files_to_translate

Browse Source 
The num_fds value in a binder_fd_array_object is bounded by the
transaction buffer. However, its in-kernel metadata is larger than the
u32 array on the wire.

On 64-bit systems, FileEntry occupies 24 bytes. About 900,000 entries
therefore make files_to_translate request roughly 20.6 MiB of
physically contiguous memory, triggering a warning in
__alloc_frozen_pages_noprof.

translate_fds() later allocates Reservation entries from the same
count. At 16 bytes per entry, this requires another 13.7 MiB contiguous
allocation.

Neither vector requires physical contiguity. Use KVVec for both so
large allocations can fall back to vmalloc.

Tested under QEMU/KVM. The 900,000-entry reproducer no longer triggers
a page allocator warning, and a 300,000-entry transaction that repeats
one valid fd reaches translate_fds() without WARN or BUG.

Found with the rust-in-peace agentic pipeline
(https://github.com/scadastrangelove/rust-in-peace).

Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Sergey Gordeychik <scadastrangelove@gmail.com>
Link: https://patch.msgid.link/20260828090757.96282-1-scadastrangelove@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Sergey Gordeychik 2026-08-28 12:07:57 +03:00 committed by Greg Kroah-Hartman
parent 8eb05e8e47
commit cad5591bc0
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/android/binder/allocation.rs
View File

@ -208,7 +208,7 @@ pub(crate) fn translate_fds(&mut self) -> Result<TranslatedFds> {
let num_close_on_free = files.iter().filter(|entry| entry.close_on_free).count();
let mut close_on_free = KVec::with_capacity(num_close_on_free, GFP_KERNEL)?;
let mut reservations = KVec::with_capacity(files.len(), GFP_KERNEL)?;
let mut reservations = KVVec::with_capacity(files.len(), GFP_KERNEL)?;
for file_info in files {
let res = FileDescriptorReservation::get_unused_fd_flags(bindings::O_CLOEXEC)?;
let fd = res.reserved_fd();
@ -567,7 +567,7 @@ fn type_to_size(type_: u32) -> Option<usize> {
#[derive(Default)]
struct FileList {
files_to_translate: KVec<FileEntry>,
files_to_translate: KVVec<FileEntry>,
close_on_free: KVec<u32>,
}
@ -581,7 +581,7 @@ struct FileEntry {
}
pub(crate) struct TranslatedFds {
reservations: KVec<Reservation>,
reservations: KVVec<Reservation>,
/// If commit is called, then these fds should be closed. (If commit is not called, then they
/// shouldn't be closed.)
close_on_free: FdsCloseOnFree,
@ -595,7 +595,7 @@ struct Reservation {
impl TranslatedFds {
pub(crate) fn new() -> Self {
Self {
reservations: KVec::new(),
reservations: KVVec::new(),
close_on_free: FdsCloseOnFree(KVec::new()),
}
}