From 9de32b62bc6c250372820414a90d577df7fe435a Mon Sep 17 00:00:00 2001 From: Alice Ryhl Date: Thu, 15 Oct 2026 09:19:41 +0000 Subject: [PATCH] rust_binder: avoid overflow in get_node_debug_info() To find the first node whose address is strictly greater than the userspace-supplied pointer, get_node_debug_info() currently searches for a lower bound of `ptr + 1`. When userspace passes `u64::MAX`, this addition overflows and triggers a kernel panic when overflow checks are enabled, or wraps around to zero otherwise. Thus, use checked_add() and skip the lookup if `ptr + 1` overflows. Fixes: f344930a163d ("rust_binder: speed up get_node_debug_info using lower_bound iter") Reported-by: syzbot+d39ca51f29c6b944a4f0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d39ca51f29c6b944a4f0 Signed-off-by: Alice Ryhl Reviewed-by: Rafael Passos Link: https://patch.msgid.link/20261015-binder-debug-info-overflow-v1-1-81fffb74d288@google.com Signed-off-by: Greg Kroah-Hartman --- drivers/android/binder/process.rs | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs index 64960857bcdc..75e1c1b3e454 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1214,10 +1214,10 @@ fn get_node_debug_info(&self, data: UserSlice) -> Result { let ptr = reader.read::()?.ptr; let mut out = BinderNodeDebugInfo::default(); - { + if let Some(start_ptr) = ptr.checked_add(1) { let inner = self.inner.lock(); // cursor_lower_bound retrieves the "key" passed or the next existing larger key - if let Some(cursor) = inner.nodes.cursor_lower_bound(&(ptr + 1)) { + if let Some(cursor) = inner.nodes.cursor_lower_bound(&start_ptr) { let (_, node) = cursor.current(); node.populate_debug_info(&mut out, &inner); }