]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
rust_binder: reject context manager self-transaction
authorKeshav Verma <iganschel@gmail.com>
Thu, 25 Jun 2026 10:39:57 +0000 (16:09 +0530)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 3 Jul 2026 10:28:43 +0000 (12:28 +0200)
commit6849cabfd30fb5727cfd31e8241e15801e17ebf9
tree91a2d7f98e182ff104ed7fa9f2bf556933e510fa
parent803c8a9502e9b97cd6ae937618ef4a8fd6274343
rust_binder: reject context manager self-transaction

Rust binder resolved handle 0 to the context manager node, but it does not
reject the case where the caller owns the same node.

The C binder driver rejects transactions from the context-manager process
to handle 0 after resolving the target node. Match that behavior in Rust
Binder by rejecting handle 0 transactions when the resolved context-manager
node is owned by the calling process.

This applies to both synchronous and oneway transactions because both paths
resolve the target through Process::get_transaction_node().

Cc: stable <stable@kernel.org>
Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
Signed-off-by: Keshav Verma <iganschel@gmail.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260625103957.730-1-iganschel@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/android/binder/process.rs