Re: [PATCH] rust_binder: enforce delivered death process ownership

[Greg Kroah-Hartman]

On Wed, Aug 05, 2026 at 05:50:56PM +0500, Daniil Detkov via B4 Relay wrote:
> From: Daniil Detkov <d4n11l@xxxxxxxxx>
> 
> The delivered_links field of NodeDeath may only be linked into the
> delivered_deaths list owned by NodeDeath::process. The existing safe
> ProcessInner::death_delivered method does not enforce that relationship,
> so safe Rust can violate the invariant relied on by a later unsafe list
> removal.
> 
> Move the insertion boundary to Process and validate both the supplied
> guard and the NodeDeath owner before mutating the list. Keep the existing
> lock order and duplicate-insertion behavior unchanged.
> 
> Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> Closes: https://github.com/Rust-for-Linux/linux/issues/1238
> Assisted-by: Codex:5.6-Sol
> Signed-off-by: Daniil Detkov <d4n11l@xxxxxxxxx>
> ---
>  drivers/android/binder/node.rs    |  6 +++++-
>  drivers/android/binder/process.rs | 23 +++++++++++++++--------
>  2 files changed, 20 insertions(+), 9 deletions(-)

Cool, how was this tested?

thanks,

greg k-h