github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rust_binder: avoid overflow in get_node_debug_info()

Browse Source 
To find the first node whose address is strictly greater than the
userspace-supplied pointer, get_node_debug_info() currently searches for
a lower bound of `ptr + 1`. When userspace passes `u64::MAX`, this
addition overflows and triggers a kernel panic when overflow checks are
enabled, or wraps around to zero otherwise. Thus, use checked_add() and
skip the lookup if `ptr + 1` overflows.

Fixes: f344930a16 ("rust_binder: speed up get_node_debug_info using lower_bound iter")
Reported-by: syzbot+d39ca51f29c6b944a4f0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d39ca51f29c6b944a4f0
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Rafael Passos <rafael@rcpassos.me>
Link: https://patch.msgid.link/20261015-binder-debug-info-overflow-v1-1-81fffb74d288@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Alice Ryhl 2026-10-15 09:19:41 +00:00 committed by Greg Kroah-Hartman
parent 10c833da4d
commit 9de32b62bc
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/android/binder/process.rs
View File

@ -1214,10 +1214,10 @@ fn get_node_debug_info(&self, data: UserSlice) -> Result {
let ptr = reader.read::<BinderNodeDebugInfo>()?.ptr;
let mut out = BinderNodeDebugInfo::default();
{
if let Some(start_ptr) = ptr.checked_add(1) {
let inner = self.inner.lock();
// cursor_lower_bound retrieves the "key" passed or the next existing larger key
if let Some(cursor) = inner.nodes.cursor_lower_bound(&(ptr + 1)) {
if let Some(cursor) = inner.nodes.cursor_lower_bound(&start_ptr) {
let (_, node) = cursor.current();
node.populate_debug_info(&mut out, &inner);
}