Repository navigation
NULL pointer deref in rust_binder_open() via rust_helper_mmgrab (binderfs, container/LXC context) #1259
Description
Kernel: 7.2.3-zen1-3-zen (Arch Linux, zen-kernel package)
Trigger: vdc (Android vdc volume abort_fuse) opening a binderfs device
Context: Inside a Waydroid LXC container using binderfs-backed anbox-binder devices
Summary
Opening a binderfs device from within an LXC container process (vdc)
triggers a NULL pointer dereference in the Rust binder driver, crashing
the calling process and leaving the binder subsystem in a bad state.
Oops
CPU: 1 UID: 1000 PID: 6244 Comm: vdc Tainted: G D OE 7.2.3-zen1-3-zen #1 PREEMPT(full)
RIP: 0010:rust_helper_mmgrab+0x4/0x10
...
Call Trace:
_RNvCsiXybHjc05XR_11rust_binder16rust_binder_open+0x142/0x490
do_dentry_open+0x13d/0x490
vfs_open+0x30/0x100
path_openat+0x4d6/0x1690
do_file_open+0x117/0x1d0
__x64_sys_openat+0xdc/0x270
do_syscall_64+0xaa/0x660
entry_SYSCALL_64_after_hwframe+0x76/0x7e
CR2: 0000000000000001
Full dmesg oops available on request / attached.
Reproduction
- Boot linux-zen 7.2.3-zen1-3-zen with
binder.devices=binder,hwbinder,vndbinder,anbox-binder,anbox-hwbinder,anbox-vndbinderon the kernel cmdline - Start a Waydroid LXC container that opens the anbox-binder binderfs devices
- Container init calls
vdc volume abort_fuse, which opens a binder device - Kernel oops fires in rust_binder_open → rust_helper_mmgrab, CR2=0x1 (near-NULL deref)
System info
$ uname -a
Linux omarchy 7.2.3-zen1-3-zen #1 PREEMPT(full) [date] x86_64 GNU/Linux
Tainted flags at time of crash: G D OE (out-of-tree module + unsigned module also loaded — nvidia proprietary driver — noting for completeness, though the crash is in rust_binder code, not nvidia)
Expected
Device open should succeed or fail gracefully (EBUSY/ENODEV), not NULL-deref.
Additional notes
This reproduces consistently when Waydroid/LXC containers touch binderfs devices under rust_binder. Switching to a kernel/config without rust_binder
(if still possible) avoids the crash, suggesting the regression is specific to the Rust binder implementation's open() path under container/
LAST THING: https://omarchy.us/ is the omarchy site if you have never heard of it
Activity
gussellers7-arch commentedon Sep 27, 2026
yes i know, written by AI, but listen, im 14 and wanna see what android is like being an apple person
(and to run android apps)
gussellers7-arch commentedon Sep 27, 2026
and for anyone asking "what dmesg" HERE:
[ 451.872799] #PF: supervisor write access in kernel mode
[ 451.872800] #PF: error_code(0x0002) - not-present page
[ 451.872801] PGD 0 P4D 0
[ 451.872803] Oops: Oops: 0002 [#228] SMP NOPTI
[ 451.872806] CPU: 1 UID: 1000 PID: 6244 Comm: vdc Tainted: G D OE 7.2.3-zen1-3-zen #1 PREEMPT(full) 181c8df8fa2631e3e88102af5725c0bacd146e57
[ 451.872808] Tainted: [D]=DIE, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
[ 451.872809] Hardware name: ASUSTeK COMPUTER INC. ASUS TUF Dash F15 FX516PM_FX516PM/FX516PM, BIOS FX516PM.330 05/15/2023
[ 451.872810] RIP: 0010:rust_helper_mmgrab+0x4/0x10
[ 451.872815] Code: 08 00 00 00 00 c3 cc cc cc cc 90 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa ff 07 e9 04 4a a7 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90
[ 451.872816] RSP: 0018:ffffd55ee265f990 EFLAGS: 00010202
[ 451.872818] RAX: ffff8edb27830000 RBX: ffff8eda1a05f800 RCX: 0000000000000000
[ 451.872819] RDX: ffffffffb36ed8eb RSI: ffffffffb1f90bd6 RDI: 0000000000000001
[ 451.872819] RBP: 0000000000000001 R08: 00000000ffffffff R09: 0000000000000000
[ 451.872820] R10: ffff8eda1a05f800 R11: 00000000ec6a336f R12: ffff8eda1a05f870
[ 451.872821] R13: ffff8edb27830000 R14: ffff8edb14c556c0 R15: ffff8eda11bb6a28
[ 451.872822] FS: 00007f7380edf000(0000) GS:ffff8eddc8123000(0000) knlGS:0000000000000000
[ 451.872823] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 451.872823] CR2: 0000000000000001 CR3: 0000000114cb9006 CR4: 0000000000f72ef0
[ 451.872824] PKRU: 55555554
[ 451.872825] Call Trace:
[ 451.872826]
[ 451.872826] _RNvCsiXybHjc05XR_11rust_binder16rust_binder_open+0x142/0x490
[ 451.872831] ? __pfx__RNvCsiXybHjc05XR_11rust_binder16rust_binder_open+0x10/0x10
[ 451.872834] do_dentry_open+0x13d/0x490
[ 451.872839] vfs_open+0x30/0x100
[ 451.872840] path_openat+0x4d6/0x1690
[ 451.872843] ? __mmap_region+0x7c6/0x1400
[ 451.872846] do_file_open+0x117/0x1d0
[ 451.872849] __x64_sys_openat+0xdc/0x270
[ 451.872850] do_syscall_64+0xaa/0x660
[ 451.872853] ? __alloc_frozen_pages_noprof+0x19e/0x370
[ 451.872855] ? __mod_memcg_lruvec_state+0x13d/0x200
[ 451.872857] ? lruvec_stat_mod_folio+0x93/0xd0
[ 451.872858] ? folio_add_lru+0xc8/0xf0
[ 451.872860] ? map_anon_folio_pte_nopf+0xc7/0x170
[ 451.872862] ? do_anonymous_page+0x437/0x8e0
[ 451.872864] ? __handle_mm_fault+0xc52/0xfd0
[ 451.872866] ? count_memcg_events+0xc5/0x180
[ 451.872868] ? handle_mm_fault+0x1dd/0x2c0
[ 451.872870] ? do_syscall_64+0x5f/0x660
[ 451.872871] ? clear_bhb_loop+0x60/0xb0
[ 451.872873] ? clear_bhb_loop+0x60/0xb0
[ 451.872874] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 451.872876] RIP: 0033:0x7f737d655b6a
[ 451.872899] Code: b8 d9 00 00 00 0f 05 48 3d 01 f0 ff ff 72 09 f7 d8 89 c7 e8 e8 f5 ff ff c3 0f 1f 80 00 00 00 00 49 89 ca b8 01 01 00 00 0f 05 <48> 3d 01 f0 ff ff 72 09 f7 d8 89 c7 e8 c5 f5 ff ff c3 0f 1f 40 00
[ 451.872900] RSP: 002b:00007ffeb63a37e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 451.872901] RAX: ffffffffffffffda RBX: 00007f7380c6bc4f RCX: 00007f737d655b6a
[ 451.872902] RDX: 0000000000080002 RSI: 00007f7380c6bc4f RDI: 00000000ffffff9c
[ 451.872903] RBP: 00007f7380c6bc4f R08: 0000000000000000 R09: 0000000000000001
[ 451.872904] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7380cf53c0
[ 451.872904] R13: 0000000000000018 R14: 00007f721d20f890 R15: 00007ffeb63a3bc0
[ 451.872906]
[ 451.872907] Modules linked in: veth overlay loop iptable_mangle xt_CHECKSUM iptable_nat xt_MASQUERADE nf_nat bridge stp llc iptable_filter ip_tables ccm rfcomm snd_seq_dummy snd_hrtimer snd_seq snd_seq_device algif_hash algif_skcipher af_alg bnep snd_hda_codec_intelhdmi vfat fat snd_sof_pci_intel_tgl snd_sof_pci_intel_cnl snd_sof_intel_hda_generic soundwire_intel snd_sof_intel_hda_sdw_bpt snd_sof_intel_hda_common snd_soc_hdac_hda snd_sof_intel_hda_mlink snd_sof_intel_hda soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_acpi_intel_match snd_soc_acpi_intel_sdca_quirks snd_hda_codec_alc269 soundwire_generic_allocation iwlmvm snd_soc_sdw_utils snd_hda_codec_realtek_lib snd_soc_acpi snd_hda_scodec_component soundwire_bus snd_hda_codec_generic snd_soc_sdca intel_rapl_msr mac80211 intel_uncore_frequency snd_hda_codec_nvhdmi crc8 intel_uncore_frequency_common snd_hda_codec_hdmi intel_tcc_cooling snd_soc_avs x86_pkg_temp_thermal intel_powerclamp coretemp snd_soc_hda_codec ptp
[ 451.872936] processor_thermal_device_pci_legacy pps_core snd_hda_intel snd_hda_ext_core libarc4 processor_thermal_device snd_hda_codec processor_thermal_wt_hint btusb platform_temperature_control btmtk snd_soc_core kvm_intel processor_thermal_soc_slider snd_hda_core btrtl iwlwifi btbcm processor_thermal_rfim snd_compress snd_intel_dspcfg btintel iTCO_wdt snd_intel_sdw_acpi processor_thermal_rapl asus_nb_wmi r8169 ac97_bus kvm mei_hdcp mei_pxp intel_rapl_common intel_pmc_bxt realtek snd_pcm_dmaengine asus_armoury snd_hwdep bluetooth processor_thermal_wt_req cfg80211 irqbypass phy_package processor_thermal_power_floor snd_pcm mdio_devres rapl i2c_i801 firmware_attributes_class hid_multitouch mei_me processor_thermal_mbox spi_nor libphy i2c_smbus snd_timer asus_wmi intel_cstate intel_uncore sparse_keymap wmi_bmof pcspkr mtd snd i2c_mux mdio_bus mei rfkill soundcore intel_soc_dts_iosf igen6_edac i2c_hid_acpi intel_pmc_core i2c_hid ucsi_acpi pmt_telemetry intel_oc_wdt int3403_thermal pmt_discovery int340x_thermal_zone
[ 451.872973] typec_ucsi roles pmt_class typec intel_pmc_ssram_telemetry mousedev int3400_thermal asus_wireless acpi_pad pinctrl_tigerlake intel_pmc_pwrm_telemetry joydev acpi_thermal_rel acpi_tad mac_hid ip6t_REJECT nf_reject_ipv6 xt_hl ip6t_rt ipt_REJECT nf_reject_ipv4 xt_LOG nf_log_syslog nft_limit xt_limit xt_addrtype xt_tcpudp xt_conntrack nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_compat x_tables nf_tables ntsync crypto_user i2c_dev zram 842_decompress 842_compress lz4hc_compress dm_crypt encrypted_keys trusted asn1_encoder tee dm_mod xe drm_suballoc_helper gpu_sched drm_gpuvm drm_gpusvm_helper nvme nvme_core nvme_keyring nvme_auth i915 aesni_intel gf128mul drm_buddy serio_raw i2c_algo_bit intel_gtt intel_lpss_pci drm_display_helper spi_intel_pci intel_lpss spi_intel intel_vsec idma64 vmd cec thunderbolt nvidia_drm(OE) drm_ttm_helper ttm drm_exec nvidia_uvm(OE) nvidia_modeset(OE) video wmi nvidia(OE) aead
[ 451.873008] CR2: 0000000000000001
[ 451.873010] ---[ end trace 0000000000000000 ]---
ojeda commentedon Sep 27, 2026
Cc @Darksonn @gregkh (and Carlos via email).
Darksonn commentedon Sep 28, 2026
Have you checked whether this is the same issue as waydroid/waydroid#2411
cmllamas commentedon Sep 28, 2026
Oh wow, pretty cool to see the Rust binder being used in Omarchy.
As pointed out by Alice, this is an "ABI mismatch" caused by bindgen miscalculating the padding in
struct task_struct. So its memory layout significantly differs from C. Can you retry with a kernel built with an updated bindgen?