Re: [PATCH 7.2.y] rust_binder: reschedule node refcount update on thread exit

[Greg Kroah-Hartman]

On Sun, Oct 11, 2026 at 06:36:08PM +0200, Miguel Ojeda wrote:
> From: Alice Ryhl <aliceryhl@xxxxxxxxxx>
> 
> commit 2a74ccd1bcc170e66525f34e9de8652b57e2cf3d upstream.
> 
> When a thread exits via BINDER_THREAD_EXIT, its pending work items are
> cancelled. If a thread exits while holding a pending node refcount
> increment (e.g. pushed as deferred work to that thread), the refcount
> increment was previously dropped because Node::cancel() and
> NodeWrapper::cancel() were no-ops.
> 
> Dropping the refcount update leaves the node's delivery state and count
> state desynchronized, and userspace will not receive the notification,
> which can cause the node to never be freed from the process's nodes tree
> when all external references are dropped.
> 
> Fix this by implementing DeliverToRead::cancel() for Node and NodeWrapper
> to move the pending refcount update to the process's work queue on thread
> exit so another thread can deliver it to userspace.
> 
> Cc: stable <stable@xxxxxxxxxx>
> Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> Signed-off-by: Alice Ryhl <aliceryhl@xxxxxxxxxx>
> Link: https://patch.msgid.link/20260903-binder-thread-exit-node-v1-1-be09ff14f6a4@xxxxxxxxxx
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> [ Dropped first argument in calls to `push_work()` to adjust to the
>   existing form without mainline commit dbb17c9ea756 ("rust_binder: move
>   (e)poll wait queue to Process"). - Miguel ]
> Signed-off-by: Miguel Ojeda <ojeda@xxxxxxxxxx>
> ---
>  drivers/android/binder/node.rs         | 20 ++++++++++++---
>  drivers/android/binder/node/wrapper.rs | 34 +++++++++++++++++++++++++-
>  2 files changed, 50 insertions(+), 4 deletions(-)
> 

Both now queued up, thanks.

greg k-h