From 9e02edea7fdbdcb76aae17e1c431c528754a241e Mon Sep 17 00:00:00 2001
From: Alice Ryhl <aliceryhl@google.com>
Date: Fri, 11 Jul 2025 09:21:56 +0000
Subject: [PATCH] ANDROID: rust_binder: use u64 for death cookie

The C Binder driver uses binder_uintptr_t for the cookie, which always
corresponds to a 64-bit integer.

Bug: 430659969
Change-Id: I6a83d0959fa97f994fb3180351329a4bf843110d
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
---
 drivers/android/binder/node.rs    | 4 ++--
 drivers/android/binder/process.rs | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/drivers/android/binder/node.rs b/drivers/android/binder/node.rs
index 738ce34776f6..b3f93616ba61 100644
--- a/drivers/android/binder/node.rs
+++ b/drivers/android/binder/node.rs
@@ -959,7 +959,7 @@ struct NodeDeathInner {
 pub(crate) struct NodeDeath {
     node: DArc<Node>,
     process: Arc<Process>,
-    pub(crate) cookie: usize,
+    pub(crate) cookie: u64,
     #[pin]
     links_track: AtomicTracker<0>,
     /// Used by the owner `Node` to store a list of registered death notifications.
@@ -988,7 +988,7 @@ impl NodeDeath {
     pub(crate) fn new(
         node: DArc<Node>,
         process: Arc<Process>,
-        cookie: usize,
+        cookie: u64,
     ) -> impl PinInit<DTRWrap<Self>> {
         DTRWrap::new(pin_init!(
             Self {
diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index c285ec0561bd..c08b46286a81 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -277,7 +277,7 @@ impl ProcessInner {
 
     /// Finds a delivered death notification with the given cookie, removes it from the thread's
     /// delivered list, and returns it.
-    fn pull_delivered_death(&mut self, cookie: usize) -> Option<DArc<NodeDeath>> {
+    fn pull_delivered_death(&mut self, cookie: u64) -> Option<DArc<NodeDeath>> {
         let mut cursor = self.delivered_deaths.cursor_front();
         while let Some(next) = cursor.peek_next() {
             if next.cookie == cookie {
@@ -1176,7 +1176,7 @@ impl Process {
         thread: &Thread,
     ) -> Result {
         let handle: u32 = reader.read()?;
-        let cookie: usize = reader.read()?;
+        let cookie: u64 = reader.read()?;
 
         // TODO: First two should result in error, but not the others.
 
@@ -1224,7 +1224,7 @@ impl Process {
 
     pub(crate) fn clear_death(&self, reader: &mut UserSliceReader, thread: &Thread) -> Result {
         let handle: u32 = reader.read()?;
-        let cookie: usize = reader.read()?;
+        let cookie: u64 = reader.read()?;
 
         let mut refs = self.node_refs.lock();
         let info = refs.by_handle.get_mut(&handle).ok_or(EINVAL)?;
@@ -1246,7 +1246,7 @@ impl Process {
         Ok(())
     }
 
-    pub(crate) fn dead_binder_done(&self, cookie: usize, thread: &Thread) {
+    pub(crate) fn dead_binder_done(&self, cookie: u64, thread: &Thread) {
         if let Some(death) = self.inner.lock().pull_delivered_death(cookie) {
             death.set_notification_done(thread);
         }