[PATCH 0/6] rust: binder: reduce `as` casts

[PATCH 0/6] rust: binder: reduce `as` casts

[Tamir Duberstein]

Follow up on the treewide Clippy lint series [1]. The Rust Binder
driver retains local allows for `clippy::ptr_as_ptr`,
`clippy::ref_as_ptr`, `clippy::as_underscore`, and
`clippy::cast_lossless` even though those lints are enabled for the
rest of the kernel.

Fix the Binder violations and remove those allows one lint at a time.
The first two patches reduce related `as` casts outside those lint
enablements: use the strict provenance APIs for Binder
pointer-to-integer conversions now that they are available at the Rust
MSRV, and transmute embedded transaction data directly instead of
round-tripping a reference through raw pointer casts.

Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-0-f43b024581e8@gmail.com [1]
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
Tamir Duberstein (6):
      rust: binder: use strict provenance APIs
      rust: binder: transmute transaction data
      rust: binder: enable `clippy::ptr_as_ptr` lint
      rust: binder: enable `clippy::ref_as_ptr` lint
      rust: binder: enable `clippy::as_underscore`
      rust: binder: enable `clippy::cast_lossless`

 drivers/android/binder/allocation.rs       |  4 ++--
 drivers/android/binder/defs.rs             |  7 ++-----
 drivers/android/binder/freeze.rs           |  2 +-
 drivers/android/binder/node.rs             | 12 ++++++------
 drivers/android/binder/node/wrapper.rs     |  2 +-
 drivers/android/binder/page_range.rs       |  8 ++++----
 drivers/android/binder/process.rs          | 12 ++++++------
 drivers/android/binder/rust_binder_main.rs | 10 ++--------
 drivers/android/binder/thread.rs           | 24 +++++++++++++-----------
 drivers/android/binder/trace.rs            |  2 +-
 drivers/android/binder/transaction.rs      | 12 ++++++------
 11 files changed, 44 insertions(+), 51 deletions(-)
---
base-commit: 5d6919055dec134de3c40167a490f33c74c12581
change-id: 20260522-binder-strict-provenance-077c5eddc943

Best regards,
--  
Tamir Duberstein <tamird@kernel.org>

[PATCH 1/6] rust: binder: use strict provenance APIs

[Tamir Duberstein]

Replace the pointer-to-integer conversions in the Binder Rust driver
with calls to the strict provenance APIs.

The strict provenance APIs were stabilized in Rust 1.84.0 [1]. Since
commit f32fb9c58a5b ("rust: bump Rust minimum supported version to
1.85.0 (Debian Trixie)"), the minimum supported Rust version is
1.85.0, so no polyfills are needed.

Link: https://blog.rust-lang.org/2025/01/09/Rust-1.84.0.html#strict-provenance-apis [1]
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
 drivers/android/binder/node.rs             | 2 +-
 drivers/android/binder/rust_binder_main.rs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 69f757ff7461..d710940c3c8f 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -321,7 +321,7 @@ pub(crate) unsafe fn remove_node_info(
     /// An id that is unique across all binder nodes on the system. Used as the key in the
     /// `by_node` map.
     pub(crate) fn global_id(&self) -> usize {
-        self as *const Node as usize
+        (self as *const Node).addr()
     }
 
     pub(crate) fn get_id(&self) -> (u64, u64) {
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index dc1941cd2407..d487638266e3 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -511,7 +511,7 @@ unsafe impl<T> Sync for AssertSync<T> {}
     _: *mut kernel::ffi::c_void,
 ) -> kernel::ffi::c_int {
     // SAFETY: Accessing the private field of `seq_file` is okay.
-    let pid = (unsafe { (*ptr).private }) as usize as Pid;
+    let pid = unsafe { (*ptr).private }.addr() as Pid;
     // SAFETY: The caller ensures that the pointer is valid and exclusive for the duration in which
     // this method is called.
     let m = unsafe { SeqFile::from_raw(ptr) };

-- 
2.54.0

[PATCH 2/6] rust: binder: transmute transaction data

[Tamir Duberstein]

`BinderTransactionData` is a transparent wrapper around
`binder_transaction_data`. Use a transmute to view the transaction data in
`BinderTransactionDataSecctx` through that wrapper, matching the safety
argument at the conversion site and avoiding the raw pointer round trip.

Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
 drivers/android/binder/defs.rs | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/drivers/android/binder/defs.rs b/drivers/android/binder/defs.rs
index 33f51b4139c7..fd0ef3f9ebd1 100644
--- a/drivers/android/binder/defs.rs
+++ b/drivers/android/binder/defs.rs
@@ -164,10 +164,7 @@ impl BinderTransactionDataSecctx {
     /// View the inner data as wrapped in `BinderTransactionData`.
     pub(crate) fn tr_data(&mut self) -> &mut BinderTransactionData {
         // SAFETY: Transparent wrapper is safe to transmute.
-        unsafe {
-            &mut *(&mut self.transaction_data as *mut uapi::binder_transaction_data
-                as *mut BinderTransactionData)
-        }
+        unsafe { core::mem::transmute(&mut self.transaction_data) }
     }
 }
 

-- 
2.54.0

[PATCH 3/6] rust: binder: enable `clippy::ptr_as_ptr` lint

[Tamir Duberstein]

In Rust 1.51.0, Clippy introduced the `ptr_as_ptr` lint [1]:

> Though `as` casts between raw pointers are not terrible,
> `pointer::cast` is safer because it cannot accidentally change pointer
> mutability or cast the pointer to other types like `usize`.

Apply the required changes and enable the lint in the Binder Rust driver
-- no functional change intended.

Link: https://rust-lang.github.io/rust-clippy/master/index.html#ptr_as_ptr [1]
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
 drivers/android/binder/page_range.rs       | 6 +++---
 drivers/android/binder/rust_binder_main.rs | 7 +------
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/page_range.rs
index e54a90e62402..927b0802e80d 100644
--- a/drivers/android/binder/page_range.rs
+++ b/drivers/android/binder/page_range.rs
@@ -571,7 +571,7 @@ pub(crate) unsafe fn read<T: FromBytes>(&self, offset: usize) -> Result<T> {
         unsafe {
             self.iterate(offset, size_of::<T>(), |page, offset, to_copy| {
                 // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
-                let obj_ptr = (out.as_mut_ptr() as *mut u8).add(out_offset);
+                let obj_ptr = out.as_mut_ptr().cast::<u8>().add(out_offset);
                 // SAFETY: The pointer points is in-bounds of the `out` variable, so it is valid.
                 page.read_raw(obj_ptr, offset, to_copy)?;
                 out_offset += to_copy;
@@ -593,7 +593,7 @@ pub(crate) unsafe fn write<T: ?Sized>(&self, offset: usize, obj: &T) -> Result {
         unsafe {
             self.iterate(offset, size_of_val(obj), |page, offset, to_copy| {
                 // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
-                let obj_ptr = (obj as *const T as *const u8).add(obj_offset);
+                let obj_ptr = (obj as *const T).cast::<u8>().add(obj_offset);
                 // SAFETY: We have a reference to the object, so the pointer is valid.
                 page.write_raw(obj_ptr, offset, to_copy)?;
                 obj_offset += to_copy;
@@ -712,7 +712,7 @@ fn drop(self: Pin<&mut Self>) {
 
     {
         // CAST: The `list_head` field is first in `PageInfo`.
-        let info = item as *mut PageInfo;
+        let info = item.cast::<PageInfo>();
         // SAFETY: The `range` field of `PageInfo` is immutable.
         range_ptr = unsafe { (*info).range };
         // SAFETY: The `range` outlives its `PageInfo` values.
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index d487638266e3..fa28697982d3 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -6,12 +6,7 @@
 
 #![crate_name = "rust_binder"]
 #![recursion_limit = "256"]
-#![allow(
-    clippy::as_underscore,
-    clippy::ref_as_ptr,
-    clippy::ptr_as_ptr,
-    clippy::cast_lossless
-)]
+#![allow(clippy::as_underscore, clippy::ref_as_ptr, clippy::cast_lossless)]
 
 use kernel::{
     bindings::{self, seq_file},

-- 
2.54.0

[PATCH 4/6] rust: binder: enable `clippy::ref_as_ptr` lint

[Tamir Duberstein]

In Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]:

> Using `as` casts may result in silently changing mutability or type.

While this does not eliminate unchecked `as` conversions, it makes such
conversions easier to scrutinize. It also has the slight benefit of
removing a degree of freedom on which to bikeshed. Thus apply the changes
and enable the lint in the Binder Rust driver -- no functional change
intended.

Link: https://rust-lang.github.io/rust-clippy/master/index.html#ref_as_ptr [1]
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
 drivers/android/binder/node.rs             | 2 +-
 drivers/android/binder/page_range.rs       | 4 ++--
 drivers/android/binder/rust_binder_main.rs | 2 +-
 drivers/android/binder/trace.rs            | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index d710940c3c8f..a4a3ddda6ac9 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -321,7 +321,7 @@ pub(crate) unsafe fn remove_node_info(
     /// An id that is unique across all binder nodes on the system. Used as the key in the
     /// `by_node` map.
     pub(crate) fn global_id(&self) -> usize {
-        (self as *const Node).addr()
+        core::ptr::from_ref(self).addr()
     }
 
     pub(crate) fn get_id(&self) -> (u64, u64) {
diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/page_range.rs
index 927b0802e80d..93e79c08b89a 100644
--- a/drivers/android/binder/page_range.rs
+++ b/drivers/android/binder/page_range.rs
@@ -312,7 +312,7 @@ pub(crate) fn register_with_vma(&self, vma: &virt::VmaNew) -> Result<usize> {
 
         // SAFETY: This just initializes the pages array.
         unsafe {
-            let self_ptr = self as *const ShrinkablePageRange;
+            let self_ptr = core::ptr::from_ref(self);
             for i in 0..num_pages {
                 let info = pages.as_mut_ptr().add(i);
                 (&raw mut (*info).range).write(self_ptr);
@@ -593,7 +593,7 @@ pub(crate) unsafe fn write<T: ?Sized>(&self, offset: usize, obj: &T) -> Result {
         unsafe {
             self.iterate(offset, size_of_val(obj), |page, offset, to_copy| {
                 // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
-                let obj_ptr = (obj as *const T).cast::<u8>().add(obj_offset);
+                let obj_ptr = core::ptr::from_ref(obj).cast::<u8>().add(obj_offset);
                 // SAFETY: We have a reference to the object, so the pointer is valid.
                 page.write_raw(obj_ptr, offset, to_copy)?;
                 obj_offset += to_copy;
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index fa28697982d3..88da29413e16 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -6,7 +6,7 @@
 
 #![crate_name = "rust_binder"]
 #![recursion_limit = "256"]
-#![allow(clippy::as_underscore, clippy::ref_as_ptr, clippy::cast_lossless)]
+#![allow(clippy::as_underscore, clippy::cast_lossless)]
 
 use kernel::{
     bindings::{self, seq_file},
diff --git a/drivers/android/binder/trace.rs b/drivers/android/binder/trace.rs
index 5539672d7285..b6cae57801fc 100644
--- a/drivers/android/binder/trace.rs
+++ b/drivers/android/binder/trace.rs
@@ -26,7 +26,7 @@
 
 #[inline]
 fn raw_transaction(t: &Transaction) -> rust_binder_transaction {
-    t as *const Transaction as rust_binder_transaction
+    core::ptr::from_ref(t).cast_mut().cast()
 }
 
 #[inline]

-- 
2.54.0

[PATCH 5/6] rust: binder: enable `clippy::as_underscore`

[Tamir Duberstein]

In Rust 1.63.0, Clippy introduced the `as_underscore` lint [1]:

> The conversion might include lossy conversion or a dangerous cast that
> might go undetected due to the type being inferred.
>
> The lint is allowed by default as using `_` is less wordy than always
> specifying the type.

Always specifying the type is especially helpful in function call
contexts where the inferred type may change at a distance. Specifying
the type also allows Clippy to spot more cases of `useless_conversion`.

While this does not eliminate unchecked `as` conversions, it makes such
conversions easier to scrutinize. It also has the slight benefit of
removing a degree of freedom on which to bikeshed. Thus apply the
changes and enable the lint in the Binder Rust driver -- no functional
change intended.

Link: https://rust-lang.github.io/rust-clippy/master/index.html#as_underscore [1]
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
 drivers/android/binder/allocation.rs       |  4 ++--
 drivers/android/binder/defs.rs             |  2 +-
 drivers/android/binder/node.rs             | 10 +++++-----
 drivers/android/binder/node/wrapper.rs     |  2 +-
 drivers/android/binder/process.rs          |  6 +++---
 drivers/android/binder/rust_binder_main.rs |  4 ++--
 drivers/android/binder/thread.rs           | 24 +++++++++++++-----------
 drivers/android/binder/transaction.rs      | 12 ++++++------
 8 files changed, 33 insertions(+), 31 deletions(-)

diff --git a/drivers/android/binder/allocation.rs b/drivers/android/binder/allocation.rs
index 0cab959e4b7e..4ac42bb7216b 100644
--- a/drivers/android/binder/allocation.rs
+++ b/drivers/android/binder/allocation.rs
@@ -376,8 +376,8 @@ pub(crate) fn transfer_binder_object(
                 BINDER_TYPE_WEAK_BINDER
             };
             newobj.flags = obj.flags;
-            newobj.__bindgen_anon_1.binder = ptr as _;
-            newobj.cookie = cookie as _;
+            newobj.__bindgen_anon_1.binder = ptr;
+            newobj.cookie = cookie;
             self.write(offset, &newobj)?;
             // Increment the user ref count on the node. It will be decremented as part of the
             // destruction of the buffer, when we see a binder or weak-binder object.
diff --git a/drivers/android/binder/defs.rs b/drivers/android/binder/defs.rs
index fd0ef3f9ebd1..a9682eb6d984 100644
--- a/drivers/android/binder/defs.rs
+++ b/drivers/android/binder/defs.rs
@@ -146,7 +146,7 @@ fn default() -> Self {
 impl BinderVersion {
     pub(crate) fn current() -> Self {
         Self(MaybeUninit::new(uapi::binder_version {
-            protocol_version: BINDER_CURRENT_PROTOCOL_VERSION as _,
+            protocol_version: BINDER_CURRENT_PROTOCOL_VERSION as i32,
         }))
     }
 }
diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index a4a3ddda6ac9..8f5307c03b1a 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -464,7 +464,7 @@ pub(crate) fn incr_refcount_allow_zero2one_with_wrapper(
         owner_inner: &mut ProcessInner,
     ) -> Option<DLArc<dyn DeliverToRead>> {
         match self.incr_refcount_allow_zero2one(strong, owner_inner) {
-            Ok(Some(node)) => Some(node as _),
+            Ok(Some(node)) => Some(node as DLArc<dyn DeliverToRead>),
             Ok(None) => None,
             Err(CouldNotDeliverCriticalIncrement) => {
                 assert!(strong);
@@ -489,8 +489,8 @@ pub(crate) fn populate_counts(
         guard: &Guard<'_, ProcessInner, SpinLockBackend>,
     ) {
         let inner = self.inner.access(guard);
-        out.strong_count = inner.strong.count as _;
-        out.weak_count = inner.weak.count as _;
+        out.strong_count = inner.strong.count as u32;
+        out.weak_count = inner.weak.count as u32;
     }
 
     pub(crate) fn populate_debug_info(
@@ -498,8 +498,8 @@ pub(crate) fn populate_debug_info(
         out: &mut BinderNodeDebugInfo,
         guard: &Guard<'_, ProcessInner, SpinLockBackend>,
     ) {
-        out.ptr = self.ptr as _;
-        out.cookie = self.cookie as _;
+        out.ptr = self.ptr;
+        out.cookie = self.cookie;
         let inner = self.inner.access(guard);
         if inner.strong.has_count {
             out.has_strong_ref = 1;
diff --git a/drivers/android/binder/node/wrapper.rs b/drivers/android/binder/node/wrapper.rs
index 43294c050502..6e4ca01c941a 100644
--- a/drivers/android/binder/node/wrapper.rs
+++ b/drivers/android/binder/node/wrapper.rs
@@ -21,7 +21,7 @@ pub(crate) fn new() -> Result<Self> {
 
     pub(super) fn init(self, node: DArc<Node>) -> DLArc<dyn DeliverToRead> {
         match self.inner.pin_init_with(DTRWrap::new(NodeWrapper { node })) {
-            Ok(initialized) => ListArc::from(initialized) as _,
+            Ok(initialized) => ListArc::from(initialized) as DLArc<dyn DeliverToRead>,
             Err(err) => match err {},
         }
     }
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 820cbd541435..3a22260eb9b4 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -259,7 +259,7 @@ pub(crate) fn new_node_ref_with_thread(
         let push = match wrapper {
             None => node
                 .incr_refcount_allow_zero2one(strong, self)?
-                .map(|node| node as _),
+                .map(|node| node as DLArc<dyn DeliverToRead>),
             Some(wrapper) => node.incr_refcount_allow_zero2one_with_wrapper(strong, wrapper, self),
         };
         if let Some(node) = push {
@@ -741,7 +741,7 @@ fn set_as_manager(
         } else {
             (0, 0, 0)
         };
-        let node_ref = self.get_node(ptr, cookie, flags as _, true, thread)?;
+        let node_ref = self.get_node(ptr, cookie, flags, true, thread)?;
         let node = node_ref.node.clone();
         self.ctx.set_manager_node(node_ref)?;
         self.inner.lock().is_manager = true;
@@ -1517,7 +1517,7 @@ fn get_frozen_status(data: UserSlice) -> Result {
 
     for ctx in crate::context::get_all_contexts()? {
         ctx.for_each_proc(|proc| {
-            if proc.task.pid() == info.pid as _ {
+            if proc.task.pid() == info.pid as i32 {
                 found = true;
                 let inner = proc.inner.lock();
                 let txns_pending = inner.txns_pending_locked();
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 88da29413e16..2c10a8cd3d88 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -6,7 +6,7 @@
 
 #![crate_name = "rust_binder"]
 #![recursion_limit = "256"]
-#![allow(clippy::as_underscore, clippy::cast_lossless)]
+#![allow(clippy::cast_lossless)]
 
 use kernel::{
     bindings::{self, seq_file},
@@ -412,7 +412,7 @@ unsafe impl<T> Sync for AssertSync<T> {}
     // SAFETY: We previously set `private_data` in `rust_binder_open`.
     let f = unsafe { Arc::<Process>::borrow((*file).private_data) };
     // SAFETY: The caller ensures that the file is valid.
-    match Process::ioctl(f, unsafe { File::from_raw_file(file) }, cmd as _, arg as _) {
+    match Process::ioctl(f, unsafe { File::from_raw_file(file) }, cmd, arg) {
         Ok(()) => 0,
         Err(err) => err.to_errno() as isize,
     }
diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
index 97d5f31e8fe3..87298a8c597d 100644
--- a/drivers/android/binder/thread.rs
+++ b/drivers/android/binder/thread.rs
@@ -666,9 +666,9 @@ fn translate_object(
                 let strong = obj.hdr.type_ == BINDER_TYPE_BINDER;
                 // SAFETY: `binder` is a `binder_uintptr_t`; any bit pattern is a valid
                 // representation.
-                let ptr = unsafe { obj.__bindgen_anon_1.binder } as _;
-                let cookie = obj.cookie as _;
-                let flags = obj.flags as _;
+                let ptr = unsafe { obj.__bindgen_anon_1.binder };
+                let cookie = obj.cookie;
+                let flags = obj.flags;
                 let node = self
                     .process
                     .as_arc_borrow()
@@ -679,7 +679,7 @@ fn translate_object(
             BinderObjectRef::Handle(obj) => {
                 let strong = obj.hdr.type_ == BINDER_TYPE_HANDLE;
                 // SAFETY: `handle` is a `u32`; any bit pattern is a valid representation.
-                let handle = unsafe { obj.__bindgen_anon_1.handle } as _;
+                let handle = unsafe { obj.__bindgen_anon_1.handle };
                 let node = self.process.get_node_from_handle(handle, strong)?;
                 security::binder_transfer_binder(&self.process.cred, &view.alloc.process.cred)?;
                 view.transfer_binder_object(offset, obj, strong, node)?;
@@ -736,7 +736,7 @@ fn translate_object(
                     ScatterGatherEntry {
                         obj_index,
                         offset: alloc_offset,
-                        sender_uaddr: obj.buffer as _,
+                        sender_uaddr: obj.buffer as usize,
                         length: obj_length,
                         pointer_fixups: KVec::new(),
                         fixup_min_offset: 0,
@@ -843,7 +843,7 @@ fn translate_object(
                     .ok_or(EINVAL)?;
 
                 let mut fda_bytes = KVec::new();
-                UserSlice::new(UserPtr::from_addr(fda_uaddr as _), fds_len)
+                UserSlice::new(UserPtr::from_addr(fda_uaddr as usize), fds_len)
                     .read_all(&mut fda_bytes, GFP_KERNEL)?;
 
                 if fds_len != fda_bytes.len() {
@@ -1365,7 +1365,7 @@ fn write(self: &Arc<Self>, req: &mut BinderWriteRead) -> Result {
         let write_start = req.write_buffer.wrapping_add(req.write_consumed);
         let write_len = req.write_size.saturating_sub(req.write_consumed);
         let mut reader =
-            UserSlice::new(UserPtr::from_addr(write_start as _), write_len as _).reader();
+            UserSlice::new(UserPtr::from_addr(write_start as usize), write_len as usize).reader();
 
         while reader.len() >= size_of::<u32>() && self.inner.lock().return_work.is_unused() {
             let before = reader.len();
@@ -1436,7 +1436,7 @@ fn read(self: &Arc<Self>, req: &mut BinderWriteRead, wait: bool) -> Result {
         let read_start = req.read_buffer.wrapping_add(req.read_consumed);
         let read_len = req.read_size.saturating_sub(req.read_consumed);
         let mut writer = BinderReturnWriter::new(
-            UserSlice::new(UserPtr::from_addr(read_start as _), read_len as _).writer(),
+            UserSlice::new(UserPtr::from_addr(read_start as usize), read_len as usize).writer(),
             self,
         );
         let (in_pool, has_transaction, thread_todo, use_proc_queue) = {
@@ -1500,9 +1500,11 @@ fn read(self: &Arc<Self>, req: &mut BinderWriteRead, wait: bool) -> Result {
 
         // Write BR_SPAWN_LOOPER if the process needs more threads for its pool.
         if has_noop_placeholder && in_pool && self.process.needs_thread() {
-            let mut writer =
-                UserSlice::new(UserPtr::from_addr(req.read_buffer as _), req.read_size as _)
-                    .writer();
+            let mut writer = UserSlice::new(
+                UserPtr::from_addr(req.read_buffer as usize),
+                req.read_size as usize,
+            )
+            .writer();
             writer.write(&BR_SPAWN_LOOPER)?;
         }
         Ok(())
diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs
index 47d5e4d88b07..6edd19461785 100644
--- a/drivers/android/binder/transaction.rs
+++ b/drivers/android/binder/transaction.rs
@@ -402,16 +402,16 @@ fn do_work(
         let tr = tr_sec.tr_data();
         if let Some(target_node) = &self.target_node {
             let (ptr, cookie) = target_node.get_id();
-            tr.target.ptr = ptr as _;
-            tr.cookie = cookie as _;
+            tr.target.ptr = ptr;
+            tr.cookie = cookie;
         };
         tr.code = self.code;
         tr.flags = self.flags;
-        tr.data_size = self.data_size as _;
-        tr.data.ptr.buffer = self.data_address as _;
-        tr.offsets_size = self.offsets_size as _;
+        tr.data_size = self.data_size as u64;
+        tr.data.ptr.buffer = self.data_address as u64;
+        tr.offsets_size = self.offsets_size as u64;
         if tr.offsets_size > 0 {
-            tr.data.ptr.offsets = (self.data_address + ptr_align(self.data_size).unwrap()) as _;
+            tr.data.ptr.offsets = (self.data_address + ptr_align(self.data_size).unwrap()) as u64;
         }
         tr.sender_euid = self.sender_euid.into_uid_in_current_ns();
         tr.sender_pid = 0;

-- 
2.54.0

[PATCH 6/6] rust: binder: enable `clippy::cast_lossless`

[Tamir Duberstein]

Before Rust 1.29.0, Clippy introduced the `cast_lossless` lint [1]:

> Rust's `as` keyword will perform many kinds of conversions, including
> silently lossy conversions. Conversion functions such as `i32::from`
> will only perform lossless conversions. Using the conversion functions
> prevents conversions from becoming silently lossy if the input types
> ever change, and makes it clear for people reading the code that the
> conversion is lossless.

While this does not eliminate unchecked `as` conversions, it makes such
conversions easier to scrutinize. It also has the slight benefit of
removing a degree of freedom on which to bikeshed. Thus apply the
changes and enable the lint in the Binder Rust driver -- no functional
change intended.

Link: https://rust-lang.github.io/rust-clippy/master/index.html#cast_lossless [1]
Signed-off-by: Tamir Duberstein <tamird@kernel.org>
---
 drivers/android/binder/freeze.rs           | 2 +-
 drivers/android/binder/process.rs          | 6 +++---
 drivers/android/binder/rust_binder_main.rs | 1 -
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/android/binder/freeze.rs b/drivers/android/binder/freeze.rs
index 53b60035639a..2178258772e5 100644
--- a/drivers/android/binder/freeze.rs
+++ b/drivers/android/binder/freeze.rs
@@ -127,7 +127,7 @@ fn do_work(
             }
 
             let mut state_info = BinderFrozenStateInfo::default();
-            state_info.is_frozen = is_frozen as u32;
+            state_info.is_frozen = u32::from(is_frozen);
             state_info.cookie = freeze.cookie.0;
             freeze.is_pending = true;
             freeze.last_is_frozen = Some(is_frozen);
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 3a22260eb9b4..fc69826d4be6 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1521,9 +1521,9 @@ fn get_frozen_status(data: UserSlice) -> Result {
                 found = true;
                 let inner = proc.inner.lock();
                 let txns_pending = inner.txns_pending_locked();
-                info.async_recv |= inner.async_recv as u32;
-                info.sync_recv |= inner.sync_recv as u32;
-                info.sync_recv |= (txns_pending as u32) << 1;
+                info.async_recv |= u32::from(inner.async_recv);
+                info.sync_recv |= u32::from(inner.sync_recv);
+                info.sync_recv |= u32::from(txns_pending) << 1;
             }
         });
     }
diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
index 2c10a8cd3d88..432390aab25b 100644
--- a/drivers/android/binder/rust_binder_main.rs
+++ b/drivers/android/binder/rust_binder_main.rs
@@ -6,7 +6,6 @@
 
 #![crate_name = "rust_binder"]
 #![recursion_limit = "256"]
-#![allow(clippy::cast_lossless)]
 
 use kernel::{
     bindings::{self, seq_file},

-- 
2.54.0

Re: [PATCH 1/6] rust: binder: use strict provenance APIs

[Alice Ryhl]

On Fri, May 22, 2026 at 07:12:46PM +0200, Tamir Duberstein wrote:
> Replace the pointer-to-integer conversions in the Binder Rust driver
> with calls to the strict provenance APIs.
> 
> The strict provenance APIs were stabilized in Rust 1.84.0 [1]. Since
> commit f32fb9c58a5b ("rust: bump Rust minimum supported version to
> 1.85.0 (Debian Trixie)"), the minimum supported Rust version is
> 1.85.0, so no polyfills are needed.
> 
> Link: https://blog.rust-lang.org/2025/01/09/Rust-1.84.0.html#strict-provenance-apis [1]
> Signed-off-by: Tamir Duberstein <tamird@kernel.org>

Reviewed-by: Alice Ryhl <aliceryhl@google.com>

Re: [PATCH 2/6] rust: binder: transmute transaction data

[Alice Ryhl]

On Fri, May 22, 2026 at 07:12:47PM +0200, Tamir Duberstein wrote:
> `BinderTransactionData` is a transparent wrapper around
> `binder_transaction_data`. Use a transmute to view the transaction data in
> `BinderTransactionDataSecctx` through that wrapper, matching the safety
> argument at the conversion site and avoiding the raw pointer round trip.
> 
> Signed-off-by: Tamir Duberstein <tamird@kernel.org>

I think it is an anti-pattern to transmute references. Please keep the
raw pointer cast.

Alice

Re: [PATCH 3/6] rust: binder: enable `clippy::ptr_as_ptr` lint

[Alice Ryhl]

On Fri, May 22, 2026 at 07:12:48PM +0200, Tamir Duberstein wrote:
> In Rust 1.51.0, Clippy introduced the `ptr_as_ptr` lint [1]:
> 
> > Though `as` casts between raw pointers are not terrible,
> > `pointer::cast` is safer because it cannot accidentally change pointer
> > mutability or cast the pointer to other types like `usize`.
> 
> Apply the required changes and enable the lint in the Binder Rust driver
> -- no functional change intended.
> 
> Link: https://rust-lang.github.io/rust-clippy/master/index.html#ptr_as_ptr [1]
> Signed-off-by: Tamir Duberstein <tamird@kernel.org>

Reviewed-by: Alice Ryhl <aliceryhl@google.com>

>  drivers/android/binder/page_range.rs       | 6 +++---
>  drivers/android/binder/rust_binder_main.rs | 7 +------
>  2 files changed, 4 insertions(+), 9 deletions(-)
> 
> diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/page_range.rs
> index e54a90e62402..927b0802e80d 100644
> --- a/drivers/android/binder/page_range.rs
> +++ b/drivers/android/binder/page_range.rs
> @@ -571,7 +571,7 @@ pub(crate) unsafe fn read<T: FromBytes>(&self, offset: usize) -> Result<T> {
>          unsafe {
>              self.iterate(offset, size_of::<T>(), |page, offset, to_copy| {
>                  // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
> -                let obj_ptr = (out.as_mut_ptr() as *mut u8).add(out_offset);
> +                let obj_ptr = out.as_mut_ptr().cast::<u8>().add(out_offset);
>                  // SAFETY: The pointer points is in-bounds of the `out` variable, so it is valid.
>                  page.read_raw(obj_ptr, offset, to_copy)?;
>                  out_offset += to_copy;
> @@ -593,7 +593,7 @@ pub(crate) unsafe fn write<T: ?Sized>(&self, offset: usize, obj: &T) -> Result {
>          unsafe {
>              self.iterate(offset, size_of_val(obj), |page, offset, to_copy| {
>                  // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
> -                let obj_ptr = (obj as *const T as *const u8).add(obj_offset);
> +                let obj_ptr = (obj as *const T).cast::<u8>().add(obj_offset);
>                  // SAFETY: We have a reference to the object, so the pointer is valid.
>                  page.write_raw(obj_ptr, offset, to_copy)?;
>                  obj_offset += to_copy;
> @@ -712,7 +712,7 @@ fn drop(self: Pin<&mut Self>) {
>  
>      {
>          // CAST: The `list_head` field is first in `PageInfo`.
> -        let info = item as *mut PageInfo;
> +        let info = item.cast::<PageInfo>();
>          // SAFETY: The `range` field of `PageInfo` is immutable.
>          range_ptr = unsafe { (*info).range };
>          // SAFETY: The `range` outlives its `PageInfo` values.
> diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
> index d487638266e3..fa28697982d3 100644
> --- a/drivers/android/binder/rust_binder_main.rs
> +++ b/drivers/android/binder/rust_binder_main.rs
> @@ -6,12 +6,7 @@
>  
>  #![crate_name = "rust_binder"]
>  #![recursion_limit = "256"]
> -#![allow(
> -    clippy::as_underscore,
> -    clippy::ref_as_ptr,
> -    clippy::ptr_as_ptr,
> -    clippy::cast_lossless
> -)]
> +#![allow(clippy::as_underscore, clippy::ref_as_ptr, clippy::cast_lossless)]
>  
>  use kernel::{
>      bindings::{self, seq_file},
> 
> -- 
> 2.54.0
> 

Re: [PATCH 5/6] rust: binder: enable `clippy::as_underscore`

[Alice Ryhl]

On Fri, May 22, 2026 at 07:12:50PM +0200, Tamir Duberstein wrote:
> In Rust 1.63.0, Clippy introduced the `as_underscore` lint [1]:
> 
> > The conversion might include lossy conversion or a dangerous cast that
> > might go undetected due to the type being inferred.
> >
> > The lint is allowed by default as using `_` is less wordy than always
> > specifying the type.
> 
> Always specifying the type is especially helpful in function call
> contexts where the inferred type may change at a distance. Specifying
> the type also allows Clippy to spot more cases of `useless_conversion`.
> 
> While this does not eliminate unchecked `as` conversions, it makes such
> conversions easier to scrutinize. It also has the slight benefit of
> removing a degree of freedom on which to bikeshed. Thus apply the
> changes and enable the lint in the Binder Rust driver -- no functional
> change intended.
> 
> Link: https://rust-lang.github.io/rust-clippy/master/index.html#as_underscore [1]
> Signed-off-by: Tamir Duberstein <tamird@kernel.org>
> ---
>  drivers/android/binder/allocation.rs       |  4 ++--
>  drivers/android/binder/defs.rs             |  2 +-
>  drivers/android/binder/node.rs             | 10 +++++-----
>  drivers/android/binder/node/wrapper.rs     |  2 +-
>  drivers/android/binder/process.rs          |  6 +++---
>  drivers/android/binder/rust_binder_main.rs |  4 ++--
>  drivers/android/binder/thread.rs           | 24 +++++++++++++-----------
>  drivers/android/binder/transaction.rs      | 12 ++++++------
>  8 files changed, 33 insertions(+), 31 deletions(-)
> 
> diff --git a/drivers/android/binder/allocation.rs b/drivers/android/binder/allocation.rs
> index 0cab959e4b7e..4ac42bb7216b 100644
> --- a/drivers/android/binder/allocation.rs
> +++ b/drivers/android/binder/allocation.rs
> @@ -376,8 +376,8 @@ pub(crate) fn transfer_binder_object(
>                  BINDER_TYPE_WEAK_BINDER
>              };
>              newobj.flags = obj.flags;
> -            newobj.__bindgen_anon_1.binder = ptr as _;
> -            newobj.cookie = cookie as _;
> +            newobj.__bindgen_anon_1.binder = ptr;
> +            newobj.cookie = cookie;

Are you sure these casts are unnecessary on all platforms?

>              self.write(offset, &newobj)?;
>              // Increment the user ref count on the node. It will be decremented as part of the
>              // destruction of the buffer, when we see a binder or weak-binder object.
> diff --git a/drivers/android/binder/defs.rs b/drivers/android/binder/defs.rs
> index fd0ef3f9ebd1..a9682eb6d984 100644
> --- a/drivers/android/binder/defs.rs
> +++ b/drivers/android/binder/defs.rs
> @@ -146,7 +146,7 @@ fn default() -> Self {
>  impl BinderVersion {
>      pub(crate) fn current() -> Self {
>          Self(MaybeUninit::new(uapi::binder_version {
> -            protocol_version: BINDER_CURRENT_PROTOCOL_VERSION as _,
> +            protocol_version: BINDER_CURRENT_PROTOCOL_VERSION as i32,

Are you sure i32 is the right type on all platforms?

>          }))
>      }
>  }
> diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
> index a4a3ddda6ac9..8f5307c03b1a 100644
> --- a/drivers/android/binder/node.rs
> +++ b/drivers/android/binder/node.rs
> @@ -464,7 +464,7 @@ pub(crate) fn incr_refcount_allow_zero2one_with_wrapper(
>          owner_inner: &mut ProcessInner,
>      ) -> Option<DLArc<dyn DeliverToRead>> {
>          match self.incr_refcount_allow_zero2one(strong, owner_inner) {
> -            Ok(Some(node)) => Some(node as _),
> +            Ok(Some(node)) => Some(node as DLArc<dyn DeliverToRead>),
>              Ok(None) => None,
>              Err(CouldNotDeliverCriticalIncrement) => {
>                  assert!(strong);
> @@ -489,8 +489,8 @@ pub(crate) fn populate_counts(
>          guard: &Guard<'_, ProcessInner, SpinLockBackend>,
>      ) {
>          let inner = self.inner.access(guard);
> -        out.strong_count = inner.strong.count as _;
> -        out.weak_count = inner.weak.count as _;
> +        out.strong_count = inner.strong.count as u32;
> +        out.weak_count = inner.weak.count as u32;

Are you sure u32 is the right type on all platforms?

>      }
>  
>      pub(crate) fn populate_debug_info(
> @@ -498,8 +498,8 @@ pub(crate) fn populate_debug_info(
>          out: &mut BinderNodeDebugInfo,
>          guard: &Guard<'_, ProcessInner, SpinLockBackend>,
>      ) {
> -        out.ptr = self.ptr as _;
> -        out.cookie = self.cookie as _;
> +        out.ptr = self.ptr;
> +        out.cookie = self.cookie;
>          let inner = self.inner.access(guard);
>          if inner.strong.has_count {
>              out.has_strong_ref = 1;
> diff --git a/drivers/android/binder/node/wrapper.rs b/drivers/android/binder/node/wrapper.rs
> index 43294c050502..6e4ca01c941a 100644
> --- a/drivers/android/binder/node/wrapper.rs
> +++ b/drivers/android/binder/node/wrapper.rs
> @@ -21,7 +21,7 @@ pub(crate) fn new() -> Result<Self> {
>  
>      pub(super) fn init(self, node: DArc<Node>) -> DLArc<dyn DeliverToRead> {
>          match self.inner.pin_init_with(DTRWrap::new(NodeWrapper { node })) {
> -            Ok(initialized) => ListArc::from(initialized) as _,
> +            Ok(initialized) => ListArc::from(initialized) as DLArc<dyn DeliverToRead>,
>              Err(err) => match err {},
>          }
>      }
> diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
> index 820cbd541435..3a22260eb9b4 100644
> --- a/drivers/android/binder/process.rs
> +++ b/drivers/android/binder/process.rs
> @@ -259,7 +259,7 @@ pub(crate) fn new_node_ref_with_thread(
>          let push = match wrapper {
>              None => node
>                  .incr_refcount_allow_zero2one(strong, self)?
> -                .map(|node| node as _),
> +                .map(|node| node as DLArc<dyn DeliverToRead>),
>              Some(wrapper) => node.incr_refcount_allow_zero2one_with_wrapper(strong, wrapper, self),
>          };
>          if let Some(node) = push {
> @@ -741,7 +741,7 @@ fn set_as_manager(
>          } else {
>              (0, 0, 0)
>          };
> -        let node_ref = self.get_node(ptr, cookie, flags as _, true, thread)?;
> +        let node_ref = self.get_node(ptr, cookie, flags, true, thread)?;

Are you sure there are no platforms that require a cast here?

>          let node = node_ref.node.clone();
>          self.ctx.set_manager_node(node_ref)?;
>          self.inner.lock().is_manager = true;
> @@ -1517,7 +1517,7 @@ fn get_frozen_status(data: UserSlice) -> Result {
>  
>      for ctx in crate::context::get_all_contexts()? {
>          ctx.for_each_proc(|proc| {
> -            if proc.task.pid() == info.pid as _ {
> +            if proc.task.pid() == info.pid as i32 {

Should use the Pid type alias.

>                  found = true;
>                  let inner = proc.inner.lock();
>                  let txns_pending = inner.txns_pending_locked();
> diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
> index 88da29413e16..2c10a8cd3d88 100644
> --- a/drivers/android/binder/rust_binder_main.rs
> +++ b/drivers/android/binder/rust_binder_main.rs
> @@ -6,7 +6,7 @@
>  
>  #![crate_name = "rust_binder"]
>  #![recursion_limit = "256"]
> -#![allow(clippy::as_underscore, clippy::cast_lossless)]
> +#![allow(clippy::cast_lossless)]
>  
>  use kernel::{
>      bindings::{self, seq_file},
> @@ -412,7 +412,7 @@ unsafe impl<T> Sync for AssertSync<T> {}
>      // SAFETY: We previously set `private_data` in `rust_binder_open`.
>      let f = unsafe { Arc::<Process>::borrow((*file).private_data) };
>      // SAFETY: The caller ensures that the file is valid.
> -    match Process::ioctl(f, unsafe { File::from_raw_file(file) }, cmd as _, arg as _) {
> +    match Process::ioctl(f, unsafe { File::from_raw_file(file) }, cmd, arg) {

Several more cases below where it's unclear whether these changes are
correct on all platforms including 32-bit targets.

>          Ok(()) => 0,
>          Err(err) => err.to_errno() as isize,
>      }
> diff --git a/drivers/android/binder/thread.rs b/drivers/android/binder/thread.rs
> index 97d5f31e8fe3..87298a8c597d 100644
> --- a/drivers/android/binder/thread.rs
> +++ b/drivers/android/binder/thread.rs
> @@ -666,9 +666,9 @@ fn translate_object(
>                  let strong = obj.hdr.type_ == BINDER_TYPE_BINDER;
>                  // SAFETY: `binder` is a `binder_uintptr_t`; any bit pattern is a valid
>                  // representation.
> -                let ptr = unsafe { obj.__bindgen_anon_1.binder } as _;
> -                let cookie = obj.cookie as _;
> -                let flags = obj.flags as _;
> +                let ptr = unsafe { obj.__bindgen_anon_1.binder };
> +                let cookie = obj.cookie;
> +                let flags = obj.flags;
>                  let node = self
>                      .process
>                      .as_arc_borrow()
> @@ -679,7 +679,7 @@ fn translate_object(
>              BinderObjectRef::Handle(obj) => {
>                  let strong = obj.hdr.type_ == BINDER_TYPE_HANDLE;
>                  // SAFETY: `handle` is a `u32`; any bit pattern is a valid representation.
> -                let handle = unsafe { obj.__bindgen_anon_1.handle } as _;
> +                let handle = unsafe { obj.__bindgen_anon_1.handle };
>                  let node = self.process.get_node_from_handle(handle, strong)?;
>                  security::binder_transfer_binder(&self.process.cred, &view.alloc.process.cred)?;
>                  view.transfer_binder_object(offset, obj, strong, node)?;
> @@ -736,7 +736,7 @@ fn translate_object(
>                      ScatterGatherEntry {
>                          obj_index,
>                          offset: alloc_offset,
> -                        sender_uaddr: obj.buffer as _,
> +                        sender_uaddr: obj.buffer as usize,
>                          length: obj_length,
>                          pointer_fixups: KVec::new(),
>                          fixup_min_offset: 0,
> @@ -843,7 +843,7 @@ fn translate_object(
>                      .ok_or(EINVAL)?;
>  
>                  let mut fda_bytes = KVec::new();
> -                UserSlice::new(UserPtr::from_addr(fda_uaddr as _), fds_len)
> +                UserSlice::new(UserPtr::from_addr(fda_uaddr as usize), fds_len)
>                      .read_all(&mut fda_bytes, GFP_KERNEL)?;
>  
>                  if fds_len != fda_bytes.len() {
> @@ -1365,7 +1365,7 @@ fn write(self: &Arc<Self>, req: &mut BinderWriteRead) -> Result {
>          let write_start = req.write_buffer.wrapping_add(req.write_consumed);
>          let write_len = req.write_size.saturating_sub(req.write_consumed);
>          let mut reader =
> -            UserSlice::new(UserPtr::from_addr(write_start as _), write_len as _).reader();
> +            UserSlice::new(UserPtr::from_addr(write_start as usize), write_len as usize).reader();
>  
>          while reader.len() >= size_of::<u32>() && self.inner.lock().return_work.is_unused() {
>              let before = reader.len();
> @@ -1436,7 +1436,7 @@ fn read(self: &Arc<Self>, req: &mut BinderWriteRead, wait: bool) -> Result {
>          let read_start = req.read_buffer.wrapping_add(req.read_consumed);
>          let read_len = req.read_size.saturating_sub(req.read_consumed);
>          let mut writer = BinderReturnWriter::new(
> -            UserSlice::new(UserPtr::from_addr(read_start as _), read_len as _).writer(),
> +            UserSlice::new(UserPtr::from_addr(read_start as usize), read_len as usize).writer(),
>              self,
>          );
>          let (in_pool, has_transaction, thread_todo, use_proc_queue) = {
> @@ -1500,9 +1500,11 @@ fn read(self: &Arc<Self>, req: &mut BinderWriteRead, wait: bool) -> Result {
>  
>          // Write BR_SPAWN_LOOPER if the process needs more threads for its pool.
>          if has_noop_placeholder && in_pool && self.process.needs_thread() {
> -            let mut writer =
> -                UserSlice::new(UserPtr::from_addr(req.read_buffer as _), req.read_size as _)
> -                    .writer();
> +            let mut writer = UserSlice::new(
> +                UserPtr::from_addr(req.read_buffer as usize),
> +                req.read_size as usize,
> +            )
> +            .writer();
>              writer.write(&BR_SPAWN_LOOPER)?;
>          }
>          Ok(())
> diff --git a/drivers/android/binder/transaction.rs b/drivers/android/binder/transaction.rs
> index 47d5e4d88b07..6edd19461785 100644
> --- a/drivers/android/binder/transaction.rs
> +++ b/drivers/android/binder/transaction.rs
> @@ -402,16 +402,16 @@ fn do_work(
>          let tr = tr_sec.tr_data();
>          if let Some(target_node) = &self.target_node {
>              let (ptr, cookie) = target_node.get_id();
> -            tr.target.ptr = ptr as _;
> -            tr.cookie = cookie as _;
> +            tr.target.ptr = ptr;
> +            tr.cookie = cookie;
>          };
>          tr.code = self.code;
>          tr.flags = self.flags;
> -        tr.data_size = self.data_size as _;
> -        tr.data.ptr.buffer = self.data_address as _;
> -        tr.offsets_size = self.offsets_size as _;
> +        tr.data_size = self.data_size as u64;
> +        tr.data.ptr.buffer = self.data_address as u64;
> +        tr.offsets_size = self.offsets_size as u64;
>          if tr.offsets_size > 0 {
> -            tr.data.ptr.offsets = (self.data_address + ptr_align(self.data_size).unwrap()) as _;
> +            tr.data.ptr.offsets = (self.data_address + ptr_align(self.data_size).unwrap()) as u64;
>          }
>          tr.sender_euid = self.sender_euid.into_uid_in_current_ns();
>          tr.sender_pid = 0;
> 
> -- 
> 2.54.0
> 

Re: [PATCH 6/6] rust: binder: enable `clippy::cast_lossless`

[Alice Ryhl]

On Fri, May 22, 2026 at 07:12:51PM +0200, Tamir Duberstein wrote:
> Before Rust 1.29.0, Clippy introduced the `cast_lossless` lint [1]:
> 
> > Rust's `as` keyword will perform many kinds of conversions, including
> > silently lossy conversions. Conversion functions such as `i32::from`
> > will only perform lossless conversions. Using the conversion functions
> > prevents conversions from becoming silently lossy if the input types
> > ever change, and makes it clear for people reading the code that the
> > conversion is lossless.
> 
> While this does not eliminate unchecked `as` conversions, it makes such
> conversions easier to scrutinize. It also has the slight benefit of
> removing a degree of freedom on which to bikeshed. Thus apply the
> changes and enable the lint in the Binder Rust driver -- no functional
> change intended.
> 
> Link: https://rust-lang.github.io/rust-clippy/master/index.html#cast_lossless [1]
> Signed-off-by: Tamir Duberstein <tamird@kernel.org>

Reviewed-by: Alice Ryhl <aliceryhl@google.com>

Re: [PATCH 4/6] rust: binder: enable `clippy::ref_as_ptr` lint

[Alice Ryhl]

On Fri, May 22, 2026 at 07:12:49PM +0200, Tamir Duberstein wrote:
> In Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]:
> 
> > Using `as` casts may result in silently changing mutability or type.
> 
> While this does not eliminate unchecked `as` conversions, it makes such
> conversions easier to scrutinize. It also has the slight benefit of
> removing a degree of freedom on which to bikeshed. Thus apply the changes
> and enable the lint in the Binder Rust driver -- no functional change
> intended.
> 
> Link: https://rust-lang.github.io/rust-clippy/master/index.html#ref_as_ptr [1]
> Signed-off-by: Tamir Duberstein <tamird@kernel.org>
> ---
>  drivers/android/binder/node.rs             | 2 +-
>  drivers/android/binder/page_range.rs       | 4 ++--
>  drivers/android/binder/rust_binder_main.rs | 2 +-
>  drivers/android/binder/trace.rs            | 2 +-
>  4 files changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
> index d710940c3c8f..a4a3ddda6ac9 100644
> --- a/drivers/android/binder/node.rs
> +++ b/drivers/android/binder/node.rs
> @@ -321,7 +321,7 @@ pub(crate) unsafe fn remove_node_info(
>      /// An id that is unique across all binder nodes on the system. Used as the key in the
>      /// `by_node` map.
>      pub(crate) fn global_id(&self) -> usize {
> -        (self as *const Node).addr()
> +        core::ptr::from_ref(self).addr()

Can we please import core::ptr?

>      }
>  
>      pub(crate) fn get_id(&self) -> (u64, u64) {
> diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/page_range.rs
> index 927b0802e80d..93e79c08b89a 100644
> --- a/drivers/android/binder/page_range.rs
> +++ b/drivers/android/binder/page_range.rs
> @@ -312,7 +312,7 @@ pub(crate) fn register_with_vma(&self, vma: &virt::VmaNew) -> Result<usize> {
>  
>          // SAFETY: This just initializes the pages array.
>          unsafe {
> -            let self_ptr = self as *const ShrinkablePageRange;
> +            let self_ptr = core::ptr::from_ref(self);
>              for i in 0..num_pages {
>                  let info = pages.as_mut_ptr().add(i);
>                  (&raw mut (*info).range).write(self_ptr);
> @@ -593,7 +593,7 @@ pub(crate) unsafe fn write<T: ?Sized>(&self, offset: usize, obj: &T) -> Result {
>          unsafe {
>              self.iterate(offset, size_of_val(obj), |page, offset, to_copy| {
>                  // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
> -                let obj_ptr = (obj as *const T).cast::<u8>().add(obj_offset);
> +                let obj_ptr = core::ptr::from_ref(obj).cast::<u8>().add(obj_offset);
>                  // SAFETY: We have a reference to the object, so the pointer is valid.
>                  page.write_raw(obj_ptr, offset, to_copy)?;
>                  obj_offset += to_copy;
> diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
> index fa28697982d3..88da29413e16 100644
> --- a/drivers/android/binder/rust_binder_main.rs
> +++ b/drivers/android/binder/rust_binder_main.rs
> @@ -6,7 +6,7 @@
>  
>  #![crate_name = "rust_binder"]
>  #![recursion_limit = "256"]
> -#![allow(clippy::as_underscore, clippy::ref_as_ptr, clippy::cast_lossless)]
> +#![allow(clippy::as_underscore, clippy::cast_lossless)]
>  
>  use kernel::{
>      bindings::{self, seq_file},
> diff --git a/drivers/android/binder/trace.rs b/drivers/android/binder/trace.rs
> index 5539672d7285..b6cae57801fc 100644
> --- a/drivers/android/binder/trace.rs
> +++ b/drivers/android/binder/trace.rs
> @@ -26,7 +26,7 @@
>  
>  #[inline]
>  fn raw_transaction(t: &Transaction) -> rust_binder_transaction {
> -    t as *const Transaction as rust_binder_transaction
> +    core::ptr::from_ref(t).cast_mut().cast()

This just removes the type annotations I had. I'm not sure it's
cleaner.

Alice

>  }
>  
>  #[inline]
> 
> -- 
> 2.54.0
> 

Re: [PATCH 2/6] rust: binder: transmute transaction data

[Tamir Duberstein]

On Tue, May 26, 2026 at 8:33 AM Alice Ryhl <aliceryhl@google.com> wrote:
>
> On Fri, May 22, 2026 at 07:12:47PM +0200, Tamir Duberstein wrote:
> > `BinderTransactionData` is a transparent wrapper around
> > `binder_transaction_data`. Use a transmute to view the transaction data in
> > `BinderTransactionDataSecctx` through that wrapper, matching the safety
> > argument at the conversion site and avoiding the raw pointer round trip.
> >
> > Signed-off-by: Tamir Duberstein <tamird@kernel.org>
>
> I think it is an anti-pattern to transmute references. Please keep the
> raw pointer cast.

Can you please elaborate? We already have this for kernel::io::Mmio:

```
  rust/kernel/io.rs-    pub fn relaxed(&self) -> &RelaxedMmio<SIZE> {
  rust/kernel/io.rs-        // SAFETY: `RelaxedMmio` is
`#[repr(transparent)]` over `Mmio`, so `Mmio<SIZE>` and
  rust/kernel/io.rs-        // `RelaxedMmio<SIZE>` have identical layout.
  rust/kernel/io.rs:        unsafe { core::mem::transmute(self) }
  rust/kernel/io.rs-    }
```

Re: [PATCH 2/6] rust: binder: transmute transaction data

[Alice Ryhl]

On Tue, May 26, 2026 at 3:34 PM Tamir Duberstein <tamird@kernel.org> wrote:
>
> On Tue, May 26, 2026 at 8:33 AM Alice Ryhl <aliceryhl@google.com> wrote:
> >
> > On Fri, May 22, 2026 at 07:12:47PM +0200, Tamir Duberstein wrote:
> > > `BinderTransactionData` is a transparent wrapper around
> > > `binder_transaction_data`. Use a transmute to view the transaction data in
> > > `BinderTransactionDataSecctx` through that wrapper, matching the safety
> > > argument at the conversion site and avoiding the raw pointer round trip.
> > >
> > > Signed-off-by: Tamir Duberstein <tamird@kernel.org>
> >
> > I think it is an anti-pattern to transmute references. Please keep the
> > raw pointer cast.
>
> Can you please elaborate? We already have this for kernel::io::Mmio:
>
> ```
>   rust/kernel/io.rs-    pub fn relaxed(&self) -> &RelaxedMmio<SIZE> {
>   rust/kernel/io.rs-        // SAFETY: `RelaxedMmio` is
> `#[repr(transparent)]` over `Mmio`, so `Mmio<SIZE>` and
>   rust/kernel/io.rs-        // `RelaxedMmio<SIZE>` have identical layout.
>   rust/kernel/io.rs:        unsafe { core::mem::transmute(self) }
>   rust/kernel/io.rs-    }
> ```

I also think that code is using the same anti-pattern.


Alice

Re: [PATCH 4/6] rust: binder: enable `clippy::ref_as_ptr` lint

[Tamir Duberstein]

On Tue, May 26, 2026 at 8:46 AM Alice Ryhl <aliceryhl@google.com> wrote:
>
> On Fri, May 22, 2026 at 07:12:49PM +0200, Tamir Duberstein wrote:
> > In Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]:
> >
> > > Using `as` casts may result in silently changing mutability or type.
> >
> > While this does not eliminate unchecked `as` conversions, it makes such
> > conversions easier to scrutinize. It also has the slight benefit of
> > removing a degree of freedom on which to bikeshed. Thus apply the changes
> > and enable the lint in the Binder Rust driver -- no functional change
> > intended.
> >
> > Link: https://rust-lang.github.io/rust-clippy/master/index.html#ref_as_ptr [1]
> > Signed-off-by: Tamir Duberstein <tamird@kernel.org>
> > ---
> >  drivers/android/binder/node.rs             | 2 +-
> >  drivers/android/binder/page_range.rs       | 4 ++--
> >  drivers/android/binder/rust_binder_main.rs | 2 +-
> >  drivers/android/binder/trace.rs            | 2 +-
> >  4 files changed, 5 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
> > index d710940c3c8f..a4a3ddda6ac9 100644
> > --- a/drivers/android/binder/node.rs
> > +++ b/drivers/android/binder/node.rs
> > @@ -321,7 +321,7 @@ pub(crate) unsafe fn remove_node_info(
> >      /// An id that is unique across all binder nodes on the system. Used as the key in the
> >      /// `by_node` map.
> >      pub(crate) fn global_id(&self) -> usize {
> > -        (self as *const Node).addr()
> > +        core::ptr::from_ref(self).addr()
>
> Can we please import core::ptr?

Of course, will do.

> >      }
> >
> >      pub(crate) fn get_id(&self) -> (u64, u64) {
> > diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/page_range.rs
> > index 927b0802e80d..93e79c08b89a 100644
> > --- a/drivers/android/binder/page_range.rs
> > +++ b/drivers/android/binder/page_range.rs
> > @@ -312,7 +312,7 @@ pub(crate) fn register_with_vma(&self, vma: &virt::VmaNew) -> Result<usize> {
> >
> >          // SAFETY: This just initializes the pages array.
> >          unsafe {
> > -            let self_ptr = self as *const ShrinkablePageRange;
> > +            let self_ptr = core::ptr::from_ref(self);
> >              for i in 0..num_pages {
> >                  let info = pages.as_mut_ptr().add(i);
> >                  (&raw mut (*info).range).write(self_ptr);
> > @@ -593,7 +593,7 @@ pub(crate) unsafe fn write<T: ?Sized>(&self, offset: usize, obj: &T) -> Result {
> >          unsafe {
> >              self.iterate(offset, size_of_val(obj), |page, offset, to_copy| {
> >                  // SAFETY: The sum of `offset` and `to_copy` is bounded by the size of T.
> > -                let obj_ptr = (obj as *const T).cast::<u8>().add(obj_offset);
> > +                let obj_ptr = core::ptr::from_ref(obj).cast::<u8>().add(obj_offset);
> >                  // SAFETY: We have a reference to the object, so the pointer is valid.
> >                  page.write_raw(obj_ptr, offset, to_copy)?;
> >                  obj_offset += to_copy;
> > diff --git a/drivers/android/binder/rust_binder_main.rs b/drivers/android/binder/rust_binder_main.rs
> > index fa28697982d3..88da29413e16 100644
> > --- a/drivers/android/binder/rust_binder_main.rs
> > +++ b/drivers/android/binder/rust_binder_main.rs
> > @@ -6,7 +6,7 @@
> >
> >  #![crate_name = "rust_binder"]
> >  #![recursion_limit = "256"]
> > -#![allow(clippy::as_underscore, clippy::ref_as_ptr, clippy::cast_lossless)]
> > +#![allow(clippy::as_underscore, clippy::cast_lossless)]
> >
> >  use kernel::{
> >      bindings::{self, seq_file},
> > diff --git a/drivers/android/binder/trace.rs b/drivers/android/binder/trace.rs
> > index 5539672d7285..b6cae57801fc 100644
> > --- a/drivers/android/binder/trace.rs
> > +++ b/drivers/android/binder/trace.rs
> > @@ -26,7 +26,7 @@
> >
> >  #[inline]
> >  fn raw_transaction(t: &Transaction) -> rust_binder_transaction {
> > -    t as *const Transaction as rust_binder_transaction
> > +    core::ptr::from_ref(t).cast_mut().cast()
>
> This just removes the type annotations I had. I'm not sure it's
> cleaner.

Would you prefer to locally disable the lint? Personally I don't find
the prior type mentions helpful: the pointer type is just the coerced
reference and the final type is the function return type, so all the
information is still plainly in view, but I don't feel strongly enough
to die on this hill; I would just like to remove the top-level lint
disablement.

Re: [PATCH 2/6] rust: binder: transmute transaction data

[Tamir Duberstein]

On Tue, May 26, 2026 at 9:36 AM Alice Ryhl <aliceryhl@google.com> wrote:
>
> On Tue, May 26, 2026 at 3:34 PM Tamir Duberstein <tamird@kernel.org> wrote:
> >
> > On Tue, May 26, 2026 at 8:33 AM Alice Ryhl <aliceryhl@google.com> wrote:
> > >
> > > On Fri, May 22, 2026 at 07:12:47PM +0200, Tamir Duberstein wrote:
> > > > `BinderTransactionData` is a transparent wrapper around
> > > > `binder_transaction_data`. Use a transmute to view the transaction data in
> > > > `BinderTransactionDataSecctx` through that wrapper, matching the safety
> > > > argument at the conversion site and avoiding the raw pointer round trip.
> > > >
> > > > Signed-off-by: Tamir Duberstein <tamird@kernel.org>
> > >
> > > I think it is an anti-pattern to transmute references. Please keep the
> > > raw pointer cast.
> >
> > Can you please elaborate? We already have this for kernel::io::Mmio:
> >
> > ```
> >   rust/kernel/io.rs-    pub fn relaxed(&self) -> &RelaxedMmio<SIZE> {
> >   rust/kernel/io.rs-        // SAFETY: `RelaxedMmio` is
> > `#[repr(transparent)]` over `Mmio`, so `Mmio<SIZE>` and
> >   rust/kernel/io.rs-        // `RelaxedMmio<SIZE>` have identical layout.
> >   rust/kernel/io.rs:        unsafe { core::mem::transmute(self) }
> >   rust/kernel/io.rs-    }
> > ```
>
> I also think that code is using the same anti-pattern.

As in previous email: please elaborate. Why is casting through pointers better?

Re: [PATCH 2/6] rust: binder: transmute transaction data

[Alice Ryhl]

On Tue, May 26, 2026 at 3:39 PM Tamir Duberstein <tamird@kernel.org> wrote:
>
> On Tue, May 26, 2026 at 9:36 AM Alice Ryhl <aliceryhl@google.com> wrote:
> >
> > On Tue, May 26, 2026 at 3:34 PM Tamir Duberstein <tamird@kernel.org> wrote:
> > >
> > > On Tue, May 26, 2026 at 8:33 AM Alice Ryhl <aliceryhl@google.com> wrote:
> > > >
> > > > On Fri, May 22, 2026 at 07:12:47PM +0200, Tamir Duberstein wrote:
> > > > > `BinderTransactionData` is a transparent wrapper around
> > > > > `binder_transaction_data`. Use a transmute to view the transaction data in
> > > > > `BinderTransactionDataSecctx` through that wrapper, matching the safety
> > > > > argument at the conversion site and avoiding the raw pointer round trip.
> > > > >
> > > > > Signed-off-by: Tamir Duberstein <tamird@kernel.org>
> > > >
> > > > I think it is an anti-pattern to transmute references. Please keep the
> > > > raw pointer cast.
> > >
> > > Can you please elaborate? We already have this for kernel::io::Mmio:
> > >
> > > ```
> > >   rust/kernel/io.rs-    pub fn relaxed(&self) -> &RelaxedMmio<SIZE> {
> > >   rust/kernel/io.rs-        // SAFETY: `RelaxedMmio` is
> > > `#[repr(transparent)]` over `Mmio`, so `Mmio<SIZE>` and
> > >   rust/kernel/io.rs-        // `RelaxedMmio<SIZE>` have identical layout.
> > >   rust/kernel/io.rs:        unsafe { core::mem::transmute(self) }
> > >   rust/kernel/io.rs-    }
> > > ```
> >
> > I also think that code is using the same anti-pattern.
>
> As in previous email: please elaborate. Why is casting through pointers better?

The reasoning is similar to the reasoning against `as` casts. In this
particular case, it may be okay, but it's not always okay because if
the reference is a wide ptr, then the layout of whether the data or
vtable pointer is stored first is not defined by Rust, and a transmute
assumes that this layout is unchanged between the two reference types.
With a cast, this potential layout divergence does not matter, as the
cast will do the right thing.

Alice