linux-kernel - Re: [PATCH] rust_binder: correctly handle FDA objects of length zero

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aVK0kS3KqUmpGSDz@google.com>
Date: Mon, 29 Dec 2025 17:04:17 +0000
From: Alice Ryhl <aliceryhl@...gle.com>
To: Gary Guo <gary@...yguo.net>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Carlos Llamas <cmllamas@...gle.com>, 
	Miguel Ojeda <ojeda@...nel.org>, Boqun Feng <boqun.feng@...il.com>, 
	"Björn Roy Baron" <bjorn3_gh@...tonmail.com>, Benno Lossin <lossin@...nel.org>, 
	Andreas Hindborg <a.hindborg@...nel.org>, Trevor Gross <tmgross@...ch.edu>, 
	Danilo Krummrich <dakr@...nel.org>, linux-kernel@...r.kernel.org, 
	rust-for-linux@...r.kernel.org, stable@...r.kernel.org, 
	DeepChirp <DeepChirp@...look.com>
Subject: Re: [PATCH] rust_binder: correctly handle FDA objects of length zero

On Mon, Dec 29, 2025 at 04:45:44PM +0000, Gary Guo wrote:
> On Mon, 29 Dec 2025 15:38:14 +0000
> Alice Ryhl <aliceryhl@...gle.com> wrote:
> 
> > Fix a bug where an empty FDA (fd array) object with 0 fds would cause an
> > out-of-bounds error. The previous implementation used `skip == 0` to
> > mean "this is a pointer fixup", but 0 is also the correct skip length
> > for an empty FDA. If the FDA is at the end of the buffer, then this
> > results in an attempt to write 8-bytes out of bounds. This is caught and
> > results in an EINVAL error being returned to userspace.
> > 
> > The pattern of using `skip == 0` as a special value originates from the
> > C-implementation of Binder. As part of fixing this bug, this pattern is
> > replaced with a Rust enum.
> 
> I was curious and checked the C binder implementation. Apparently the C
> binder implementation returns early when translating a FD array with
> length 0.
> 
> Would it still make sense to do something similar in the Rust binder? The
> enum change is still good to make, though.

Based on where the early return is, that'd be equivalent in wrapping
this:

	parent_entry
	    .pointer_fixups
	    .push(
	        PointerFixupEntry::Skip {
	            skip: fds_len,
	            target_offset: info.target_offset,
	        },
	        GFP_KERNEL,
	    )
	    .map_err(|_| ENOMEM)?;

in an `if fds_len > 0 {}` block. I don't believe it makes any
difference, but not having a special case may be cleaner?

Alice