diff options
| author | Alice Ryhl <aliceryhl@google.com> | 2026-10-15 09:19:41 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-10-18 10:22:49 +0200 |
| commit | 9de32b62bc6c250372820414a90d577df7fe435a (patch) | |
| tree | 39c82a9ed5bbfaef08b552bfe6f78d77db76313e /tools/perf/scripts/python | |
| parent | 10c833da4dde3d9bb19e2092a33abafdaa16a341 (diff) | |
| download | lwn-9de32b62bc6c250372820414a90d577df7fe435a.tar.gz lwn-9de32b62bc6c250372820414a90d577df7fe435a.zip | |
rust_binder: avoid overflow in get_node_debug_info()
To find the first node whose address is strictly greater than the
userspace-supplied pointer, get_node_debug_info() currently searches for
a lower bound of `ptr + 1`. When userspace passes `u64::MAX`, this
addition overflows and triggers a kernel panic when overflow checks are
enabled, or wraps around to zero otherwise. Thus, use checked_add() and
skip the lookup if `ptr + 1` overflows.
Fixes: f344930a163d ("rust_binder: speed up get_node_debug_info using lower_bound iter")
Reported-by: syzbot+d39ca51f29c6b944a4f0@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d39ca51f29c6b944a4f0
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Rafael Passos <rafael@rcpassos.me>
Link: https://patch.msgid.link/20261015-binder-debug-info-overflow-v1-1-81fffb74d288@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions