rust_binder: avoid overflow in get_node_debug_info()
To find the first node whose address is strictly greater than the
userspace-supplied pointer, get_node_debug_info() currently searches for
a lower bound of `ptr + 1`. When userspace passes `u64::MAX`, this
addition overflows and triggers a kernel panic when overflow checks are
enabled, or wraps around to zero otherwise. Thus, use checked_add() and
skip the lookup if `ptr + 1` overflows.
Fixes: f344930a163d ("rust_binder: speed up get_node_debug_info using lower_bound iter")
Reported-by: syzbot+d39ca51f29c6b944a4f0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d39ca51f29c6b944a4f0
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Rafael Passos <rafael@rcpassos.me>
Link: https://patch.msgid.link/20261015-binder-debug-info-overflow-v1-1-81fffb74d288@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 file changed