[PATCH] rust_binder: reject context manager self-transaction

[PATCH] rust_binder: reject context manager self-transaction

[Keshav Verma]

Rust binder resolved handle 0 to the context manager node, but it does not
reject the case where the caller owns the same node.

The C binder driver rejects transactions from the context-manager process
to handle 0 after resolving the target node. Match that behavior in Rust
Binder by rejecting handle 0 transactions when the resolved context-manager
node is owned by the calling process.

This applies to both synchronous and oneway transactions because both paths
resolve the target through Process::get_transaction_node().

Cc: stable@kernel.org
Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
Signed-off-by: Keshav Verma <iganschel@gmail.com>
---
 drivers/android/binder/process.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index d09facebddf6..5befff9cf5b9 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -901,7 +901,11 @@ pub(crate) fn insert_or_update_handle(
     pub(crate) fn get_transaction_node(&self, handle: u32) -> BinderResult<NodeRef> {
         // When handle is zero, try to get the context manager.
         if handle == 0 {
-            Ok(self.ctx.get_manager_node(true)?)
+            let node_ref = self.ctx.get_manager_node(true)?;
+            if core::ptr::eq(self, &*node_ref.node.owner) {
+                return Err(EINVAL.into());
+            }
+            Ok(node_ref)
         } else {
             Ok(self.get_node_from_handle(handle, true)?)
         }
-- 
2.39.5

[PATCH v2] rust_binder: reject context manager self-transaction

[Keshav Verma]

Rust binder resolved handle 0 to the context manager node, but it does not
reject the case where the caller owns the same node.

The C binder driver rejects transactions from the context-manager process
to handle 0 after resolving the target node. Match that behavior in Rust
Binder by rejecting handle 0 transactions when the resolved context-manager
node is owned by the calling process.

This applies to both synchronous and oneway transactions because both paths
resolve the target through Process::get_transaction_node().

Cc: stable@kernel.org
Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
Signed-off-by: Keshav Verma <iganschel@gmail.com>
---
Changes in v2:
- Compare the underlying OS process task instead of Rust Binder `Process` object.

 drivers/android/binder/process.rs | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index d09facebddf6..13ecd3048b89 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -901,7 +901,11 @@ pub(crate) fn insert_or_update_handle(
     pub(crate) fn get_transaction_node(&self, handle: u32) -> BinderResult<NodeRef> {
         // When handle is zero, try to get the context manager.
         if handle == 0 {
-            Ok(self.ctx.get_manager_node(true)?)
+            let node_ref = self.ctx.get_manager_node(true)?;
+            if self.task == node_ref.node.owner.task {
+                return Err(EINVAL.into());
+            }
+            Ok(node_ref)
         } else {
             Ok(self.get_node_from_handle(handle, true)?)
         }
-- 
2.39.5

Re: [PATCH v2] rust_binder: reject context manager self-transaction

[Alice Ryhl]

On Mon, Jun 22, 2026 at 08:28:01PM +0530, Keshav Verma wrote:
> Rust binder resolved handle 0 to the context manager node, but it does not
> reject the case where the caller owns the same node.
> 
> The C binder driver rejects transactions from the context-manager process
> to handle 0 after resolving the target node. Match that behavior in Rust
> Binder by rejecting handle 0 transactions when the resolved context-manager
> node is owned by the calling process.
> 
> This applies to both synchronous and oneway transactions because both paths
> resolve the target through Process::get_transaction_node().
> 
> Cc: stable@kernel.org
> Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> Signed-off-by: Keshav Verma <iganschel@gmail.com>
> ---
> Changes in v2:
> - Compare the underlying OS process task instead of Rust Binder `Process` object.

I would prefer to compare the Binder Process object. Rejecting
transactions between different fds owned by the same process doesn't
really have any benefit and makes fuzz testing much harder.

Alice

Re: [PATCH v2] rust_binder: reject context manager self-transaction

[Carlos Llamas]

On Tue, Jun 23, 2026 at 11:37:11AM +0000, Alice Ryhl wrote:
> On Mon, Jun 22, 2026 at 08:28:01PM +0530, Keshav Verma wrote:
> > Rust binder resolved handle 0 to the context manager node, but it does not
> > reject the case where the caller owns the same node.
> > 
> > The C binder driver rejects transactions from the context-manager process
> > to handle 0 after resolving the target node. Match that behavior in Rust
> > Binder by rejecting handle 0 transactions when the resolved context-manager
> > node is owned by the calling process.
> > 
> > This applies to both synchronous and oneway transactions because both paths
> > resolve the target through Process::get_transaction_node().
> > 
> > Cc: stable@kernel.org
> > Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> > Signed-off-by: Keshav Verma <iganschel@gmail.com>
> > ---
> > Changes in v2:
> > - Compare the underlying OS process task instead of Rust Binder `Process` object.
> 
> I would prefer to compare the Binder Process object. Rejecting
> transactions between different fds owned by the same process doesn't
> really have any benefit and makes fuzz testing much harder.
> 
> Alice

Hey Alice,

The restrictions were added in the C version in order to patch
vulnerabilities associated with this "self-transaction" behavior.
See: http://git.kernel.org/torvalds/c/4b836a1426cb

I haven't really looked much into this, but do we even need this for the
Rust version? Is this even fixing anything at all?

--
Carlos Llamas

Re: [PATCH v2] rust_binder: reject context manager self-transaction

[Alice Ryhl]

On Thu, Jun 25, 2026 at 2:38 AM Carlos Llamas <cmllamas@google.com> wrote:
>
> On Tue, Jun 23, 2026 at 11:37:11AM +0000, Alice Ryhl wrote:
> > On Mon, Jun 22, 2026 at 08:28:01PM +0530, Keshav Verma wrote:
> > > Rust binder resolved handle 0 to the context manager node, but it does not
> > > reject the case where the caller owns the same node.
> > >
> > > The C binder driver rejects transactions from the context-manager process
> > > to handle 0 after resolving the target node. Match that behavior in Rust
> > > Binder by rejecting handle 0 transactions when the resolved context-manager
> > > node is owned by the calling process.
> > >
> > > This applies to both synchronous and oneway transactions because both paths
> > > resolve the target through Process::get_transaction_node().
> > >
> > > Cc: stable@kernel.org
> > > Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
> > > Signed-off-by: Keshav Verma <iganschel@gmail.com>
> > > ---
> > > Changes in v2:
> > > - Compare the underlying OS process task instead of Rust Binder `Process` object.
> >
> > I would prefer to compare the Binder Process object. Rejecting
> > transactions between different fds owned by the same process doesn't
> > really have any benefit and makes fuzz testing much harder.
> >
> > Alice
>
> Hey Alice,
>
> The restrictions were added in the C version in order to patch
> vulnerabilities associated with this "self-transaction" behavior.
> See: http://git.kernel.org/torvalds/c/4b836a1426cb
>
> I haven't really looked much into this, but do we even need this for the
> Rust version? Is this even fixing anything at all?

Even if there's no vulnerability, self-transactions are still very
weird and may introduce edge cases I can't think of. I would prefer to
reject them.

Alice