Re: [PATCH] rust_binder: enforce delivered death process ownership

On Wednesday, August 5th, 2026 at 6:13 PM, Greg Kroah-Hartman <[email protected]> wrote:

> On Wed, Aug 05, 2026 at 05:50:56PM +0500, Daniil Detkov via B4 Relay wrote:
> > From: Daniil Detkov <[email protected]>
> >
> > The delivered_links field of NodeDeath may only be linked into the
> > delivered_deaths list owned by NodeDeath::process. The existing safe
> > ProcessInner::death_delivered method does not enforce that relationship,
> > so safe Rust can violate the invariant relied on by a later unsafe list
> > removal.
> >
> > Move the insertion boundary to Process and validate both the supplied
> > guard and the NodeDeath owner before mutating the list. Keep the existing
> > lock order and duplicate-insertion behavior unchanged.
> >
> > Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> > Closes: https://github.com/Rust-for-Linux/linux/issues/1238
> > Assisted-by: Codex:5.6-Sol
> > Signed-off-by: Daniil Detkov <[email protected]>
> > ---
> >  drivers/android/binder/node.rs    |  6 +++++-
> >  drivers/android/binder/process.rs | 23 +++++++++++++++--------
> >  2 files changed, 20 insertions(+), 9 deletions(-)
> 
> Cool, how was this tested?
> 
> thanks,
> 
> greg k-h
> 

Hi Greg,

It was built and checked against rust-fixes with:

  make LLVM=1 CLIPPY=1 O=... -j32 drivers/android/binder/
  make LLVM=1 O=... rustfmtcheck
  make LLVM=1 O=... -j32 bzImage

I booted the resulting x86_64 kernel with
CONFIG_ANDROID_BINDER_IPC_RUST=y under QEMU/KVM, mounted the binder
filesystem, opened the binder device, and verified that BINDER_VERSION
returned protocol 8. The boot completed without a BUG, Oops, or panic.

This covered the valid Binder open/ioctl path. The issue report contains
an in-kernel PoC for the mismatched NodeDeath/Process insertion; I had
not run that PoC when submitting v1.

If it would be useful, I can also set up and run the in-kernel PoC from
the report against both the pre-fix and patched trees.

Thanks,
Daniil