[PATCH] rust_binder: avoid overflow in get_node_debug_info()

[PATCH] rust_binder: avoid overflow in get_node_debug_info()

[Alice Ryhl]

To find the first node whose address is strictly greater than the
userspace-supplied pointer, get_node_debug_info() currently searches for
a lower bound of `ptr + 1`. When userspace passes `u64::MAX`, this
addition overflows and triggers a kernel panic when overflow checks are
enabled, or wraps around to zero otherwise. Thus, use checked_add() and
skip the lookup if `ptr + 1` overflows.

Fixes: f344930a163d ("rust_binder: speed up get_node_debug_info using lower_bound iter")
Reported-by: syzbot+d39ca51f29c6b944a4f0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d39ca51f29c6b944a4f0
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
---
 drivers/android/binder/process.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 64960857bcdc..75e1c1b3e454 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1214,10 +1214,10 @@ fn get_node_debug_info(&self, data: UserSlice) -> Result {
         let ptr = reader.read::<BinderNodeDebugInfo>()?.ptr;
         let mut out = BinderNodeDebugInfo::default();
 
-        {
+        if let Some(start_ptr) = ptr.checked_add(1) {
             let inner = self.inner.lock();
             // cursor_lower_bound retrieves the "key" passed or the next existing larger key
-            if let Some(cursor) = inner.nodes.cursor_lower_bound(&(ptr + 1)) {
+            if let Some(cursor) = inner.nodes.cursor_lower_bound(&start_ptr) {
                 let (_, node) = cursor.current();
                 node.populate_debug_info(&mut out, &inner);
             }

---
base-commit: 7e170600b36298cba2ba7a0c63d1cebea7970708
change-id: 20261015-binder-debug-info-overflow-397b2d61a594

Best regards,
-- 
Alice Ryhl <aliceryhl@google.com>

Re: [PATCH] rust_binder: avoid overflow in get_node_debug_info()

[Rafael Passos]

I wish I had though of that when making the previous change.
A very elegant check, as returning "out"" with the default value is safe
:)

Reviewed-by: Rafael Passos <rafael@rcpassos.me>

Thanks (and sorry),
Rafael Passos