Re: [PATCH] rust_binder: enforce delivered death process ownership

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Aug 05, 2026 at 02:28:38PM +0000, Daniil Detkov wrote:
> On Wednesday, August 5th, 2026 at 6:13 PM, Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
> > On Wed, Aug 05, 2026 at 05:50:56PM +0500, Daniil Detkov via B4 Relay wrote:
> > > From: Daniil Detkov <d4n11l@proton.me>
> > >
> > > The delivered_links field of NodeDeath may only be linked into the
> > > delivered_deaths list owned by NodeDeath::process. The existing safe
> > > ProcessInner::death_delivered method does not enforce that relationship,
> > > so safe Rust can violate the invariant relied on by a later unsafe list
> > > removal.
> > >
> > > Move the insertion boundary to Process and validate both the supplied
> > > guard and the NodeDeath owner before mutating the list. Keep the existing
> > > lock order and duplicate-insertion behavior unchanged.
> > >
> > > Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> > > Closes: https://github.com/Rust-for-Linux/linux/issues/1238
> > > Assisted-by: Codex:5.6-Sol
> > > Signed-off-by: Daniil Detkov <d4n11l@proton.me>
> > > ---
> > >  drivers/android/binder/node.rs    |  6 +++++-
> > >  drivers/android/binder/process.rs | 23 +++++++++++++++--------
> > >  2 files changed, 20 insertions(+), 9 deletions(-)
> > 
> > Cool, how was this tested?
> > 
> > thanks,
> > 
> > greg k-h
> > 
> 
> Hi Greg,
> 
> It was built and checked against rust-fixes with:
> 
>   make LLVM=1 CLIPPY=1 O=... -j32 drivers/android/binder/
>   make LLVM=1 O=... rustfmtcheck
>   make LLVM=1 O=... -j32 bzImage
> 
> I booted the resulting x86_64 kernel with
> CONFIG_ANDROID_BINDER_IPC_RUST=y under QEMU/KVM, mounted the binder
> filesystem, opened the binder device, and verified that BINDER_VERSION
> returned protocol 8. The boot completed without a BUG, Oops, or panic.
> 
> This covered the valid Binder open/ioctl path. The issue report contains
> an in-kernel PoC for the mismatched NodeDeath/Process insertion; I had
> not run that PoC when submitting v1.
> 
> If it would be useful, I can also set up and run the in-kernel PoC from
> the report against both the pre-fix and patched trees.

You are going to have to at least exercise your new code changes, just
doing a version number isn't that much of a test :)

thanks,

greg k-h