From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4127F35F163 for ; Thu, 11 Jun 2026 07:42:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.73 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781163770; cv=none; b=oxSAxqSf8E38005cEilOsmNlnuYaeCqJlUftw2MTxulJt4f0tVpXW84ggI/qmbdafgXdd8hhSFDi1hXcgmavLdC5nrmzzRNgqhJGhkk9uxbN7iGlO5H0dAXQp4s4eVdwa+LpnFjKKD2BXA4fXwWdIR8HiHXse9AM3klI7vJkHyk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781163770; c=relaxed/simple; bh=9Hi5G83dO7QXkCQSBytppdeMnz3hjd8brQd7w5LIyDY=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=iR9XT38P/qgvQTjjHtoJqTR03m4oMpe048sKX/qESmsAyTQ1QxwYKEWcUrKZwPTWQllbFdm2x1N4eVnpDB5XKwSlqjaisnTOPPSq46B2ILx5qzfb2DD83dcgkiZqBQ82EpPp6DxnhYzPOj9tsMnHPAN329Gf4RorjRde/pZJUdk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=PeunyJ9t; arc=none smtp.client-ip=209.85.128.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--aliceryhl.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="PeunyJ9t" Received: by mail-wm1-f73.google.com with SMTP id 5b1f17b1804b1-490abeb7298so79287225e9.2 for ; Thu, 11 Jun 2026 00:42:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1781163767; x=1781768567; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:from:to:cc:subject:date:message-id :reply-to; bh=2QS/QG8pusntP+r54WiP07pgkraUAuj5JsutpBJR8Ac=; b=PeunyJ9tgzfGrcGSmVv/ByrczxZf3y45aXjyBatQB2wYSx1h/NEBabznV8hKWm9BP2 Iirb2jyEHUSq0yAJfgAXzSqpOWGpd055OJNyM+z5qqCt7hX570l24/VTFDlJ4aa6g/EX kjd86xYfdIF9f0zI45XV1nKIDsPs1zcs4uhsZ7wecd5wt/2C53R5JnB51DxfVBwsHrIX upVZtCd3wlTtrVjWWwCeTU6xAYEpiUznu+ZMylIQB8glWVznr4+1FeI/hLH15WmKpxuX WSoOf6f+0S1J1aHrapaX2Ae4DMfhvidUVbZ4/qQ6zGPN4gIxqUu+6eA8DS86BcJkW+Fp UvLQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781163767; x=1781768567; h=content-transfer-encoding:cc:to:from:subject:message-id:references :mime-version:in-reply-to:date:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=2QS/QG8pusntP+r54WiP07pgkraUAuj5JsutpBJR8Ac=; b=aqj09Iy1P87RHhic2UGDBhmL6TyYJ6spbr0+q6bD63QIgWCgZbuiXgo8sF3/3tWiF8 wlY2/ZH+Nit6N9q4PLwPhWZY5ad4ZrGEsGDKXL9y5JPZQIu3xnyxegtFtTbFkk2N0xQi C+ieYNwPPFYBbni44lleUH5cZ8d1gYjR7tsTeadTL+sfTxHKVeQXNlMMrk6apUDa9H2T bY/gzD46Avy37Bu+8/aFehWGITL7MAjHY0lpc1SywRumgQMcpLfYuhYmqwRqsmHMGdYo E/FkUgPq3evjupBfpJfxtmjRQrpjD1wVqoNLoMWtDbms4yX6NGeIhuBfuYPceFZXNUMx GoIg== X-Forwarded-Encrypted: i=1; AFNElJ9ffe1Z6EBf94pBySWFhyUkCmOkGXqH5ce17yr6j5RgbPaDCPozS8ThYC/RGVqC28cWDegn4bKxVAdN1Fw=@vger.kernel.org X-Gm-Message-State: AOJu0YzJK1SGAu+h2tSVR8EdEZ/eQIP2aaPZc5+qiSo/Z3FoYANJh0Bw hJ8geXwI1BCfUmt+JUHaHB6E6JmhLLVhjoSuu33vrwh0gLxqty/yyfuORf7Y8RINP+0mAJ3i1mR Coi+6RmC0kXzDZ+qIgg== X-Received: from wmv21.prod.google.com ([2002:a05:600c:26d5:b0:48a:79a9:335c]) (user=aliceryhl job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:3105:b0:490:d38c:7836 with SMTP id 5b1f17b1804b1-490e55d0fa5mr19190645e9.3.1781163766573; Thu, 11 Jun 2026 00:42:46 -0700 (PDT) Date: Thu, 11 Jun 2026 07:42:45 +0000 In-Reply-To: <20260610133241.374115-1-georgeandrout13@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260610035544.3333022-1-georgeandrout13@gmail.com> <20260610133241.374115-1-georgeandrout13@gmail.com> Message-ID: Subject: Re: [PATCH v2] rust_binder: add ownership assertion to Node::add_death From: Alice Ryhl To: Georgios Androutsopoulos Cc: Greg Kroah-Hartman , Carlos Llamas , "Arve =?utf-8?B?SGrDuG5uZXbDpWc=?=" , Todd Kjos , Christian Brauner , Miguel Ojeda , Boqun Feng , Gary Guo , "=?utf-8?B?QmrDtnJu?= Roy Baron" , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Paul Moore , "Onur =?utf-8?B?w5Z6a2Fu?=" , linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable On Wed, Jun 10, 2026 at 09:32:39AM -0400, Georgios Androutsopoulos wrote: > The `// SAFETY:` comment in NodeDeath::set_cleared assumes that a > NodeDeath is never inserted into the death list of any Node other than > its owner. However, this invariant is not enforced by the safe function > Node::add_death, which inserts NodeDeath into the death list without > checking that death.node =3D=3D self, leaving a risk for future code that > may miss this implicit invariant and cause undefined behavior. >=20 > Add an assertion to make this precondition explicit and catch potential > violations early. >=20 > Link: https://github.com/Rust-for-Linux/linux/issues/1237 >=20 > Signed-off-by: Georgios Androutsopoulos > --- > Changes in v2: > - Replace assert!() with pr_warn() + debug_assert() following > feedback from Onur =C3=96zkan and Miguel Ojeda. >=20 > Link to v1: https://lore.kernel.org/rust-for-linux/20260610035544.3333022= -1-georgeandrout13@gmail.com/ > --- > drivers/android/binder/node.rs | 5 +++++ > 1 file changed, 5 insertions(+) >=20 > diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node= .rs > index 69f757ff7461..425076405e1e 100644 > --- a/drivers/android/binder/node.rs > +++ b/drivers/android/binder/node.rs > @@ -333,6 +333,11 @@ pub(crate) fn add_death( > death: ListArc, 1>, > guard: &mut Guard<'_, ProcessInner, SpinLockBackend>, > ) { > + let is_valid =3D core::ptr::eq(self, &**death.node); > + if !is_valid { > + pr_warn!("attempt to add NodeDeath to the wrong death list\n= "); > + } > + debug_assert!(is_valid); If this assertion fails we should not continue. Either use a full panic, or do a warn_on! and return without adding it. Alice