[v2] binder: fix issues with mremap()

[PATCH v2 0/5] binder: fix issues with mremap()

Carlos Llamas posted 5 patches 3 weeks, 4 days ago

Diff against v3 v4
Download series mbox

There is a newer version of this series

drivers/android/binder.c             | 12 +++++++++++-
drivers/android/binder/page_range.rs | 15 ++++++++++++---
drivers/android/binder/process.rs    |  1 +
3 files changed, 24 insertions(+), 4 deletions(-)

Expand all Fold all

[PATCH v2 0/5] binder: fix issues with mremap()

Posted by Carlos Llamas 3 weeks, 4 days ago

This is a follow up series fixing some pre-existing issues found by
sashiko during a review of an unrelated patchset here:
https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@google.com

The goal is to safely reject mremap() requests on binder's vma to
prevent pages from temporary leaking and accidental IPC tear-down.

--
v2:
 - Set VM_DONTEXPAND in [1/5] and [2/5] per Sashiko's feedback.
 - Check vma->vm_start to prevent incorrect ->close() in [3/5] per
   Sashiko's feedback.

v1:
https://lore.kernel.org/all/20260831224145.169403-1-cmllamas@google.com/

Carlos Llamas (5):
  binder: set VM_DONTEXPAND
  rust_binder: set VM_DONTEXPAND
  binder: check vma->vm_start in binder_vma_close()
  binder: reject mremap()
  rust_binder: reject mremap()

 drivers/android/binder.c             | 12 +++++++++++-
 drivers/android/binder/page_range.rs | 15 ++++++++++++---
 drivers/android/binder/process.rs    |  1 +
 3 files changed, 24 insertions(+), 4 deletions(-)

-- 
2.55.0.897.gb25b4bd76c-goog