linux.git/drivers/android/binder/thread.rs, branch v7.2-rc5

rust_binder: only print failure if error has source

2026-07-17T13:30:09+00:00

The commit that fixes BINDER_GET_EXTENDED_ERROR changed the condition
for printing transaction failures so errors are printed even if the
cause is a dead or frozen process. Undo this change so that the error
is only printed if the failure has an errno associated with it.

Cc: stable@kernel.org
Fixes: 77bfebf11077 ("rust_binder: fix BINDER_GET_EXTENDED_ERROR")
Signed-off-by: Alice Ryhl 
Link: https://patch.msgid.link/20260708-get-extended-error-fix-printing-v1-1-6e293b213b70@google.com
Signed-off-by: Greg Kroah-Hartman

rust_binder: fix BINDER_GET_EXTENDED_ERROR

2026-07-03T10:18:59+00:00

This code currently copies the ExtendedError struct to the stack,
modifies the copy, and then doesn't modify the original. Thus, fix it.

Furthermore, errors when replying must be delivered directly to the
remote thread, so update deliver_reply() to take an extended error
argument.

Cc: stable 
Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
Signed-off-by: Alice Ryhl 
Acked-by: Carlos Llamas 
Link: https://patch.msgid.link/20260605-set-extended-error-v3-1-d60b69a75f97@google.com
Signed-off-by: Greg Kroah-Hartman

rust_binder: add `command`/`return` tracepoints

2026-04-01T10:18:22+00:00

Add Rust Binder `command` and `return` tracepoint declarations and
wire them in where BC commands are parsed and BR return codes are
emitted to userspace.

Signed-off-by: Mohamad Alsadhan 
Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-6-6fae4fbcf637@sdhn.cc
Signed-off-by: Greg Kroah-Hartman

rust_binder: add fd translation tracepoints

2026-04-01T10:18:22+00:00

Add Rust Binder tracepoint declarations for both `transaction_fd_send`
and `transaction_fd_recv`. Also, wire in the corresponding trace calls
where fd objects are serialised/deserialised.

Signed-off-by: Mohamad Alsadhan 
Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-5-6fae4fbcf637@sdhn.cc
Signed-off-by: Greg Kroah-Hartman

rust_binder: add `wait_for_work` tracepoint

2026-04-01T10:18:22+00:00

Add the Rust Binder `wait_for_work` tracepoint declaration and wire
it into the thread read path before selecting the work source.

Signed-off-by: Mohamad Alsadhan 
Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-3-6fae4fbcf637@sdhn.cc
Signed-off-by: Greg Kroah-Hartman

rust_binder: add ioctl/read/write done tracepoints

2026-04-01T10:18:22+00:00

Add Rust Binder tracepoints declarations for `ioctl_done`,
`read_done` and `write_done`.

Additionally, wire in the new tracepoints into the corresponding
Binder call sites.

Note that the new tracepoints report final errno-style return values,
matching the existing C model for operation completion.

Signed-off-by: Mohamad Alsadhan 
Link: https://patch.msgid.link/20260317-rust-binder-trace-v3-2-6fae4fbcf637@sdhn.cc
Signed-off-by: Greg Kroah-Hartman

rust_binder: introduce TransactionInfo

2026-03-31T13:13:56+00:00

Rust Binder exposes information about transactions that are sent in
various ways: printing to the kernel log, tracepoints, files in
binderfs, and the upcoming netlink support. Currently all these
mechanisms use disparate ways of obtaining the same information, so
let's introduce a single Info struct that collects all the required
information in a single place, so that all of these different mechanisms
can operate in a more uniform way.

For now, the new info struct is only used to replace a few things:
* The BinderTransactionDataSg struct that is passed as an argument to
  several methods is removed as the information is moved into the new
  info struct and passed down that way.
* The oneway spam detection fields on Transaction and Allocation can be
  removed, as the information can be returned to the caller via the
  mutable info struct instead.
But several other uses of the info struct are planned in follow-up
patches.

Signed-off-by: Alice Ryhl 
Link: https://patch.msgid.link/20260306-transaction-info-v1-1-fda58fca558b@google.com
Signed-off-by: Greg Kroah-Hartman

Merge 7.0-rc4 into char-misc-next

2026-03-16T10:41:58+00:00

We need the char/misc/iio fixes in this branch as well to build on top
of.

Signed-off-by: Greg Kroah-Hartman

rust_binder: avoid name mangling for get_work[_local]

2026-02-27T05:34:54+00:00

Currently ps -A shows processes waiting on schedule() in functions with
names such as do_epoll_wait, wait_woken, and the impeccably named
_RNvMs2_NtCs8QPsHWIn21X_16rust_binder_main6threadNtB5_6Thread8get_work.

To improve how ps output looks, give explicit non-mangled names to the
functions where Rust Binder calls schedule(), since these are the most
likely places to show up on ps output.

The name of rust_binder_waitlcl is truncated instead of using _local
suffix because rust_binder_wait_local is sufficiently long that ps shows
unaligned output.

This is intended to be a temporary workaround until we find a better
solution. Adding #[export_name] to every Rust function that calls
schedule() is not a great long-term solution.

Suggested-by: Matthew Maurer 
Signed-off-by: Alice Ryhl 
Acked-by: Gary Guo 
Link: https://patch.msgid.link/20260219-rust-binder-ps-v2-1-773eca09c125@google.com
Signed-off-by: Greg Kroah-Hartman

rust_binder: avoid reading the written value in offsets array

2026-02-27T05:32:59+00:00

When sending a transaction, its offsets array is first copied into the
target proc's vma, and then the values are read back from there. This is
normally fine because the vma is a read-only mapping, so the target
process cannot change the value under us.

However, if the target process somehow gains the ability to write to its
own vma, it could change the offset before it's read back, causing the
kernel to misinterpret what the sender meant. If the sender happens to
send a payload with a specific shape, this could in the worst case lead
to the receiver being able to privilege escalate into the sender.

The intent is that gaining the ability to change the read-only vma of
your own process should not be exploitable, so remove this TOCTOU read
even though it's unexploitable without another Binder bug.

Cc: stable 
Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver")
Reported-by: Jann Horn 
Reviewed-by: Jann Horn 
Signed-off-by: Alice Ryhl 
Acked-by: Liam R. Howlett 
Link: https://patch.msgid.link/20260218-binder-vma-check-v2-2-60f9d695a990@google.com
Signed-off-by: Greg Kroah-Hartman