From nobody Sat Sep 26 13:46:59 2026 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3A7832B114 for ; Tue, 1 Sep 2026 03:04:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231865; cv=none; b=H3BE9zlvRMdhgstzs2M4rJ2pIafa2J5A6eqxtGECu2qvZ0tWaV08w9MFQ+Ecv+CtR8hDNdeY02jH7dtosw0wkxRfd/rtu3xjmPApiQzr4v1P/KKPOn4sRWuO9XSWm4dwGYoEDNsJYq4cqKUVur1W01w0NZ8Thh8posWguBEQxrc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231865; c=relaxed/simple; bh=alwkBD/+SQUXc6OQqN4BOwQT8uua2JgeRzRa5U2y8kY=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=O0WZ7HVmgFNW/MqMOQHVBfPLUMVMGSMvyWk8Zbx+fx/2c0xj9s1lGli1t3c7ookHv19RI7kJOJgygZp1hGW+3eiqJqJGGkGKuN80AYVIUpgryXRg3mwIyykXdUTI45MIEwWcvfEP6zWwFRQOFe27sOvp/WU/CHjv+cANxprozhg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=q4h0KaET; arc=none smtp.client-ip=209.85.216.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="q4h0KaET" Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-3965ba1ba3eso5620163a91.2 for ; Mon, 31 Aug 2026 20:04:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788231863; x=1788836663; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=N3TdueNSyiGTL64eGdavHuKzRARmETdxICv7py0WGZo=; b=q4h0KaETtAlhpO/xAM8S7pXm4VcQ7A15cxx2FQOcVenHS0FuKYLfvCtA1tQ6P3QHwa 54rP5j4npT5LYQpgmCNGdL4DWIQcOCW+hboOHmcGg4aXEVPJgK6KnA18Yfqf2II2+JEz 6NdPZqj9bU/fndX53t8JHGM9cmBxhzXdcHQB2y79UTmD7i0Nzouxp5xyA9HnWqgDV1bn eSqMI/HHxrM+iKqe9+hSaqglYnsRSjhxx/rg70AA25abWVJi2wB2WuBm43koYuZRpTHz HjGJV36pBePE20kAjNEmsUS9ZDgAkQYBklWH0ZjOPYyx8RzUDh9OHV9g573LkVRHOKbH CU/w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788231863; x=1788836663; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=N3TdueNSyiGTL64eGdavHuKzRARmETdxICv7py0WGZo=; b=r3L4ng6vVQLbXyVKH0Qn6be3z/8mszzEi8InUMfl/VfPeBHRcdxjvpYrt6bbW5WcxN VAsR1xz7/YX5e8XqoDLkDHC04dTnYTsZCsM4700jBLe4OaWKI8feCoM1pIaJ3OEiSFoQ bQGAaw2f8Y8HmvEIPzCPLc2tjIxT0tAY5E4usb78kBQ+iABTivbDQVIdV11lyYXpHf2m Chrn2okUL4VztcM4Rzy/YOdPSgGBmn51dYCDKEFH7aEQ0CsDkqngIoAjarwQIbzpF9vA xXftKdrBKyQu7xisbgV3aJQzNeSD/uO9fwSBXfYunBs3PfRgsLL+eJXcc2Nkk2kFqHXU s22A== X-Forwarded-Encrypted: i=1; AKwUvByFMxp6xkKULjHonPt7F6Cee4h1mI3R4qUeMPWj6kAfaKO8WEMZV1N4Oa4RX0DvYemNGVy5hgWDhCV2BZQ=@vger.kernel.org X-Gm-Message-State: AFuF++kiKooywjNzf4oLTvW7zcGqPGujFiDvgSsAuYl2OfU9/Yjrda8i Q46vG5Up4O49teBQSXfxLX0YPPswhBWWSYWEdD0UYL7gnY4u0eEnN0OVwhnb69hgkDDD4Wxf4qK fbaEdkRNdvCfy+w== X-Received: from dyx8.prod.google.com ([2002:a05:693c:8208:b0:32d:dd4b:f2b8]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:54d0:b0:398:d93a:b343 with SMTP id 98e67ed59e1d1-39907ab0ec5mr7583812a91.3.1788231863112; Mon, 31 Aug 2026 20:04:23 -0700 (PDT) Date: Tue, 1 Sep 2026 03:04:12 +0000 In-Reply-To: <20260901030419.470246-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901030419.470246-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.897.gb25b4bd76c-goog Message-ID: <20260901030419.470246-2-cmllamas@google.com> Subject: [PATCH v2 1/5] binder: set VM_DONTEXPAND From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support expanding VMAs. It caches the original size under alloc->buffer_size during mmap() and expanding the VMA would only result in a wasted virtual range. Set the VM_DONTEXPAND flag to prevent the vma from being expanded via mremap(). Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas%40g= oogle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 8f2ef1bd539f..1b492ed48ea6 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6056,7 +6056,8 @@ static int binder_mmap(struct file *filp, struct vm_a= rea_struct *vma) proc->pid, vma->vm_start, vma->vm_end, "bad vm_flags", -EPERM); return -EPERM; } - vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP, VM_MAYWRITE); + vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP | VM_DONTEXPAND, + VM_MAYWRITE); =20 vma->vm_ops =3D &binder_vm_ops; vma->vm_private_data =3D proc; --=20 2.55.0.897.gb25b4bd76c-goog From nobody Sat Sep 26 13:46:59 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64FD4415B62 for ; Tue, 1 Sep 2026 03:04:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231867; cv=none; b=QmFaco7xTbNARohjetX3OvBDtXTs5vnLIHqNvPpDNZHF9asHtL/Uxyux0vXNSZlM4794JhMWnYf8kbw0ha1Cl35utUXu5o9N2nwC2yTRl84hWVTaCbjF39aZX5EXNe98LfhllZKjZ2LuS45k+Vaxp800SPpy6vAw3sg7DVSgiKU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231867; c=relaxed/simple; bh=ZVDmy6VjoBuiJ9n9p6Ad1YWPKaC9lxc9NZ2K2c+ucEM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=BPEg/5FKLAtR4SKo53dwuW/pRx3px6t7r5bi1ICDiBDa4zDUi+amr9UBghpK74GLMZ+b9w9PnxfNDzHkMda/DDyrF0UM/AybgnCqkQpqJ7KFagNNs/3ziqeWzSw3wICHl/Bd+YV+FhVpr6t/wu8SZ54Er+Y4t+lxRcXEuwGMVz8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bhzRUiAt; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bhzRUiAt" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-38e475f83a2so289235a91.1 for ; Mon, 31 Aug 2026 20:04:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788231865; x=1788836665; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=8F8BdKyQbDU8LQ8WvhzelWDzD39wCf1FJtyBP4q/yWc=; b=bhzRUiAt8cG08SVMAC6Q9OqM3zOxPbhVYTK5Lbru9MADIq8Agqore1soqohOOrpo3y 1HlR05GOHy0V3QpzdsoXGQ5GpSxzwPxbJOtvNgoh4hFZ8LdR1Gf4MgkOOTQFA89qz4Hj ehO6XqlZP8MkLZvzNr+P3TXgekS3o7Y5Qt4DRj6oaCDUL/bTO3WPeVeRCq1VGZyrYsEq XT0STyKMqMc4zjrynImJUVOYhSDd7MOgFLxGO2qOSiyaSe10MuQnuuysROTx5AJZiJGy pk7upWX+f7ZZDqV/uwDqw/22PvXdMQ1+c8eR1ticskfzWof+xUFmtDEk6Z5oFbWAGZxX op8g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788231865; x=1788836665; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8F8BdKyQbDU8LQ8WvhzelWDzD39wCf1FJtyBP4q/yWc=; b=P1poJVvd1DcDWhy8yrbb1WhWoffnpJBh6SVGUBVRwYNuQzIhcFaVFKSsTOncuzo0aa /4TUeURIczi8DGPhEsn22rzWuvlQunxtBzZ66GXVoLwl0EL14wbfjq7+MwNMfsjD0Ct8 1LLtNzB6H6s1oKfXAMHKZsqhDydSq+xxyCioe9VwlGPTGeTHAvtlOslWr8WvPXTISBH5 /5qa2JBQPPnTrtRxVEruGuIvzhe7hhbi8aBXn7NeggE70IXR6Vkt4CfQnbp9wVKr3YsI EKWujqlZvB9110oG7hkj0Dt8S6mtlX59PXpY9AqRusltVyIy0UzZk6uLy900qtTPBlNt xMXQ== X-Forwarded-Encrypted: i=1; AKwUvBy5APjM1Q4Js9k9Ns+2IO5hBZ9miJJj6P6koPgcijXDJTv4UlUJXk8jcc+jn3BY4dK8H+1zdSwnNd1NJvc=@vger.kernel.org X-Gm-Message-State: AFuF++n0WIzg9gk/O33Kt6S67YXN30BWucp/7JyVUX1zXCIStCH2GW7H L+NlXCrwREg6UgDjui2uJc7r9fjzNX26ZF4chcu1XMjEZz2UQqz5lfa0Vxwuedpjd7wmyq8u+U/ GBrMzzUMRvlt0Qg== X-Received: from dlbrs15.prod.google.com ([2002:a05:7022:f68f:b0:13d:1da6:85cf]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90a:1c08:b0:399:1b08:28de with SMTP id 98e67ed59e1d1-3991b082a7emr1620892a91.7.1788231864463; Mon, 31 Aug 2026 20:04:24 -0700 (PDT) Date: Tue, 1 Sep 2026 03:04:13 +0000 In-Reply-To: <20260901030419.470246-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901030419.470246-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.897.gb25b4bd76c-goog Message-ID: <20260901030419.470246-3-cmllamas@google.com> Subject: [PATCH v2 2/5] rust_binder: set VM_DONTEXPAND From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support expanding VMAs. It uses the original size to create its RangeAllocator during mmap() and expanding the VMA would only result in a wasted virtual range. Set the VM_DONTEXPAND flag to prevent the vma from being expanded via mremap(). Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas%40g= oogle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder/process.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index 5372bfbd93b3..9038f3d13cfd 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1786,6 +1786,7 @@ pub(crate) fn mmap( vma.try_clear_maywrite().map_err(|_| EPERM)?; vma.set_dontcopy(); vma.set_mixedmap(); + vma.set_dontexpand(); =20 // TODO: Set ops. We need to learn when the user unmaps so that we= can stop using it. this.create_mapping(vma) --=20 2.55.0.897.gb25b4bd76c-goog From nobody Sat Sep 26 13:46:59 2026 Received: from mail-pg1-f200.google.com (mail-pg1-f200.google.com [209.85.215.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 887A3414A1D for ; Tue, 1 Sep 2026 03:04:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231867; cv=none; b=Bdwy3CZ3nPuNX5dZhZ9QkrEGeKOUKMNKyG42SvdrdeHj416jT26qlPAiCv9vNKmUliY4XqRG4xbqio/E0xsz6fxWh/FNix5Rpeztx7mEeqjLpENrXO0R7mX3/W8Xh32ZCiUcrF7xIqkb/LYfZ9G6HD84yrvJdL/akjOOfk3KJJE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231867; c=relaxed/simple; bh=QaT3nycN1nU+767e6gGU2hQy4Jh8Zmp8/ztDqnMyiNU=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fn7e/I+ythSAr88qtK/d/slqwwNyLRehbpIfmMi2bWosZLq3ykehgbnaPgZmA8gdJ+8QCE0dfdsCGD5TlTYToLveGnfO1qhT4RNRwggXLRIgSbLnT97uuFMMgdem5JkXLfu6XH64zcOYgy6bk0WxWN1fcGmUeU0tEOJWY3JIgyk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=rGrP46m0; arc=none smtp.client-ip=209.85.215.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="rGrP46m0" Received: by mail-pg1-f200.google.com with SMTP id 41be03b00d2f7-cbb92868263so3717456a12.2 for ; Mon, 31 Aug 2026 20:04:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788231866; x=1788836666; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=j4kY4yMnAUzFdJb35gMXcen7Y7r8uKRQU8t9+ieisNw=; b=rGrP46m0mv9VyZK3ltDaSaLMchOP69AJMxy1d3MFvw5r+kanjEhD2iG08J79/Qs2YQ 3Qu8Hn6fcqgfXfzo7KyokBAU/fM2qrz5mzdkckY0uathI/RVmZLMYugNYmaid+z9OvX8 YdMlJtV8Tf3M+3DUgL6+PXa99kELizb8qxKBI9zZzmiSOewdnh2hP0W4wGZF1TgxucR1 pYoXZZGQU7LuY5g4FHaD9xAvLyTMhxCfIMems4sE50nDSktDt2Jk4jBPjUsmG1mzmoTL YgDpMx7awRl3sKa2q+oXlq32IMglo3CWjeOaM9np76z2HIns4Y3j3mkyNL7cpFpADTOv Tjsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788231866; x=1788836666; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=j4kY4yMnAUzFdJb35gMXcen7Y7r8uKRQU8t9+ieisNw=; b=YxElO1fG184/kt/gZo6D3eFCQkNyWiokyavZt8QS88OdyH+4IgvGXy1upVD/lDgsi4 3h3Ng3H56JycQHtIqMQa71MrZH4ePtJ1lr7vsbLlBsF1XHRHBn9PbVO2U2pnfT4xFOtU QRra2ysV/NMwQSV3+UEwPSe0sjNDhoKuZDgfnA6SKNidLHZU/QyEKnfXYNOOm1Jbkyby I9eEAP+bz25MqNio5o7zTjG4bI30OZOQIRcla/HiMnU6DKgUiKPnE7taddDN5xXKNsMW /jzCV5QVmEFyRg7UDvRaMEJSBIsSiVGQzf6EJU39uvS024AvBMUjyhzedq02PvHBL0y2 12Jg== X-Forwarded-Encrypted: i=1; AHgh+RpEIhJHVflIOQ+qatstAQCZgRx99oca86LWOh6hU4PFEi/hXFKZhBcUmBogtzgyBgx+B8BCJKc2b6SVji4=@vger.kernel.org X-Gm-Message-State: AFuF++kof3OfeIR43HY9v/O6o20rpBhZGR4+VhEUeepJ7sHLA2VvMskY OW1GLqGD4knZr40RGnhxxRYk4oXEl2jI/sNMkxPJby9cUSMfoZcjM8zPs5vLqngXt535j8zbkUG Xysr3iiFDBeT2zw== X-Received: from dybgl8.prod.google.com ([2002:a05:7300:e008:b0:322:9543:a5f9]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:2d2c:b0:3d1:39e9:b261 with SMTP id adf61e73a8af0-3d7aacd026bmr8048089637.0.1788231865714; Mon, 31 Aug 2026 20:04:25 -0700 (PDT) Date: Tue, 1 Sep 2026 03:04:14 +0000 In-Reply-To: <20260901030419.470246-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901030419.470246-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.897.gb25b4bd76c-goog Message-ID: <20260901030419.470246-4-cmllamas@google.com> Subject: [PATCH v2 3/5] binder: check vma->vm_start in binder_vma_close() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Certain operations like a failed mremap() might trigger vm_ops->close() on temporary mappings. To avoid tearing-down the main binder mapping on these, let's verify that the VMA matches the expected starting address. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas%40g= oogle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 1b492ed48ea6..3ec3a77af106 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6018,6 +6018,9 @@ static void binder_vma_close(struct vm_area_struct *v= ma) { struct binder_proc *proc =3D vma->vm_private_data; =20 + if (vma->vm_start !=3D proc->alloc.vm_start) + return; + binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, --=20 2.55.0.897.gb25b4bd76c-goog From nobody Sat Sep 26 13:46:59 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C605A411A18 for ; Tue, 1 Sep 2026 03:04:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231869; cv=none; b=NJhoMvViHkqUj8mrYMzpNknX6ucuJeYN0YQ5iv3NaYrHMsfqQlcwKfV4PtUhdrn6ECVZGr0vd6tKJ608Od5XtbGpTwoYIRFxzPMuKZvRQ4eS5eLbfFaT/UUbhr/ieb1RW7mvM13aorjlgyDPswD4g1TKP9NsI80KP3H6TFxFLD0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231869; c=relaxed/simple; bh=FYJGCs95rbkXTqTszYu9UYLZw63d0p3ONXrb2Y+bMxg=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=P9FGUeZcZXiZGfwBuHG+Pz4SmEhdn8ho1jOdcGTuUNpCje56OYBmkB6rzDhnQdyEN4iTE5gTosH5TyAr0YNy9BxTtpuuCc6WKa7Z4ykkTy9eN9VBJsh6fUnRetAtyAFYLWU9ry+a+gLTdAdxoBTjyjdM1vrRPfDKxTjGV0f22X8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=vt/prHi4; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="vt/prHi4" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-388b404eaa4so6316238a91.0 for ; Mon, 31 Aug 2026 20:04:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788231867; x=1788836667; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=72CFr2m2ySU0zy95uI9pzFm3dRMmgX65Gs74KePjPwg=; b=vt/prHi4HgO+sEC9NTa/4D8Mq6EEvOrJZljj9LK00yCWbiUj950MKZrGFyXFmQ0uyx 9gyzbIvz8hXGU7O+AG2wUNpDsFb60B6X1vwi1i/QGBrjqXI01OyC8cfOyHtS+vVhLTGL HdegrcyH7bLBlY8Vvm+PyHqcshBygxfvyQqdIXrcc6yyBpvuWAPmW7bPCwS27/y/qJRa IKyUqjAR/6lGFPo9cw1AV19WLHi3fTcmBtMIwOemA42l88gJaboYipa9+R/uBbj417+w V39pnL67xevnvO40Paw5sCGD7VO3u1T/UvSsAF2wAchua/N3qS8r9W1balVL6BAkcLWY rjaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788231867; x=1788836667; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=72CFr2m2ySU0zy95uI9pzFm3dRMmgX65Gs74KePjPwg=; b=Wt97VjZHlFjCdPCfTGLIo3TRScdmgaN0PpIXGJJNAtOCVhDVbfKnXFWCs+lvX0m0yg U6eQ5poBwxnDovOAsRC6ZC4P+s4Uy4/0edOmtFf/fuq2p79KOk//NkiclqcnPmnpEms/ 7eYjzKHAZgOUWyIPkZVdNOJ9Z3/KQY3Sh9NczBVpEKLSkgR4Kn32NNTmVLmsYsc88Ock yI0YOX3EAvJ+h7sxIG5lRy6davRxEFTkfde/xOvF9FAB2HT6ddAWnRBvfEXQV5lHJB8S ZXfklm05PSPgJLG1XRljhPx1p5LkuOaiDLArK8AldiffhSpmQf0szZghKjcW1w9bRxtP 044w== X-Forwarded-Encrypted: i=1; AKwUvBxr66D/uvxK6Bde8GIhYHk5TZ+NA4y/w0OlHgdPtMkkC+lCC3GDL0BihQLAba3m9ZmqpIhTSNM0zUC98eE=@vger.kernel.org X-Gm-Message-State: AFuF++mAndRhNF06+a/XKIOKRdh5Wu6hvJt7c3Hr1WeK6BWFGiJINRuQ scIVygBJe9WjkrlXwhcJMHvzZD7+8b0puyoXiy5OQxDLwLkfU/53OoRGbEbrrgBY+KTfQcjAuNg ueN3DzW5qgLAoiQ== X-Received: from dlbtp2.prod.google.com ([2002:a05:7022:3b82:b0:141:2c5a:38a5]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:4a52:b0:393:288:29e3 with SMTP id 98e67ed59e1d1-396d0eda189mr41806788a91.10.1788231866976; Mon, 31 Aug 2026 20:04:26 -0700 (PDT) Date: Tue, 1 Sep 2026 03:04:15 +0000 In-Reply-To: <20260901030419.470246-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901030419.470246-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.897.gb25b4bd76c-goog Message-ID: <20260901030419.470246-5-cmllamas@google.com> Subject: [PATCH v2 4/5] binder: reject mremap() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support mremap() as it caches the mapping address in alloc->vm_start. Moving the mapping breaks the IPC communication for the process and can temporarily leak pages during a shrinker reclaim. Fix this by explicitly rejecting the .mremap() operation. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb%40go= ogle.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 3ec3a77af106..76fc2edc1937 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6035,10 +6035,16 @@ VISIBLE_IF_KUNIT vm_fault_t binder_vm_fault(struct = vm_fault *vmf) } EXPORT_SYMBOL_IF_KUNIT(binder_vm_fault); =20 +static int binder_mremap(struct vm_area_struct *vma) +{ + return -EINVAL; +} + static const struct vm_operations_struct binder_vm_ops =3D { .open =3D binder_vma_open, .close =3D binder_vma_close, .fault =3D binder_vm_fault, + .mremap =3D binder_mremap, }; =20 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) --=20 2.55.0.897.gb25b4bd76c-goog From nobody Sat Sep 26 13:46:59 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D58A23955C1 for ; Tue, 1 Sep 2026 03:04:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231875; cv=none; b=jyEarK5AjrANpJuB5Vaujtj0gXAe9p1aTd/Fckpqet8w39RdYKU8ZHX6zT3hZEIj+YvUmOlt+1Byl06z2DHuJ8Uuvxxq+Xx9udMbKt25PKAzbfCpRNC33mxk/S3KRUTT6j6ZwLsE9v4gGMfkV8oPlEihBgkWBgypGYctcfC+jmk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788231875; c=relaxed/simple; bh=8KcSgffxAkB1OeS3/kdkp5OoiPWVBES6SdR64YQAb54=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=CpTV8Z8y82aQMeMZSRISR6sgs56e3Q9hBiaZJTgBmkx5QLg1sK7D+n8ScadYx0+NB2UW40lJh5OJVsn5G7hepRN3X0F6d9lkcyMDJN+bca07XJYyh6oqTevMQyYlXXs5dL6VBpxSxhBkeSpmpoFqPcTHU+C6Vn/OQIQ0gov2278= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=s8Y436D5; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="s8Y436D5" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-38e54b6556aso5760155a91.2 for ; Mon, 31 Aug 2026 20:04:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788231869; x=1788836669; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=wgNVfGlbCEyq8MC5JaRKbxi7I9+N7W9TiHIhv9t8nRg=; b=s8Y436D5DrAn6S4iama2Vq3ITv2A86+qPIGZlFc6tQf/O3fyDbdYNTNd6O0w0hi5nk +mY+04o4xQM/PFjhF2KusvPSmPdi2rlwnA2l7AGPLnGKK00955RuN7pZT0zFZSZu4iG0 JY4gmE+j7Q/oSypTYXKqWBNebBMM5LorMjmHaxqXZT3NHFw356CJl9K3W6Iq/SQ2NkIh TQSjVoT1vBy9+0XGCre3QVVGm+3hTZN7X/o3e87nVg4eghfLqIDmNBxWsH7+tYQ9RYbF 2kQQImkBTxdcUIrUZEEVAd2AMhF7+RNBdZYfNDPl8krUUooCAObn5FpEtmxmdez2QBKb 3Ukg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788231869; x=1788836669; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wgNVfGlbCEyq8MC5JaRKbxi7I9+N7W9TiHIhv9t8nRg=; b=tEWEv0y6AUDkiWIogi/BFv9HUI91ainlZjtXRsU4XR2HkoqQReIMK37Ysh8xAB/oq1 irivarzWcDlDbBJEGjPIpUPCct54yblWwNVsjPcKYdOZnugwOuxR7vkaFVnywEC7EFIB cDLrjGFPY82F6AztnAEcBOGYVTIleOe/S4xt3MOF2vY5RlBux08s7rz3MFJxMEULysjj /nLaJ9wJaI+4i7Iap3E7pick6l0hqir5sbvpZjD3uPEOo42dUEfM5ePFogCvpIvo2Ys0 PuIF4cJYga8WqX/OWM7L+3ES3ZPmg4NXE7qvnEiYqxibpcI3p536Uhfl30jNecVvqF+U WFLQ== X-Forwarded-Encrypted: i=1; AKwUvBwqgZSGX59uP9bz//7V1Js11PX859kfWpoh5AlH/WZIjAarMCRwNrpM1Q/Ke9CQESTDSpnjd4N8sCegzdY=@vger.kernel.org X-Gm-Message-State: AFuF++m90K0UhIHeKAkCnNnzm3yug9IslneuTRe740/T9tKYq3Eiujsr CjA6kNVFbLFt8nYG+q1W2bCjVtpxxrqDU5ps9gF8Zrgfkou/lU43WuFaNY1+UJWoVfV4XioEVvE YgqzOiAD094KEwQ== X-Received: from dycev8.prod.google.com ([2002:a05:7301:d588:b0:328:5a01:ea69]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90a:d887:b0:398:9c0c:7c71 with SMTP id 98e67ed59e1d1-3989c0c7fdcmr33560585a91.24.1788231868274; Mon, 31 Aug 2026 20:04:28 -0700 (PDT) Date: Tue, 1 Sep 2026 03:04:16 +0000 In-Reply-To: <20260901030419.470246-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901030419.470246-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.897.gb25b4bd76c-goog Message-ID: <20260901030419.470246-6-cmllamas@google.com> Subject: [PATCH v2 5/5] rust_binder: reject mremap() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl , Benno Lossin , Gary Guo Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko , "open list:RUST [PIN-INIT]:Keyword:bpin-initb|pin_initb|PinInit" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support mremap() as it caches the mapping address in Inner::vma_addr. Moving the mapping breaks the IPC communication for the process and can temporarily leak pages during a shrinker reclaim. Fix this by explicitly rejecting the .mremap() operation. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb%40go= ogle.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder/page_range.rs | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/= page_range.rs index 52ffbf3504e7..411efcc2116f 100644 --- a/drivers/android/binder/page_range.rs +++ b/drivers/android/binder/page_range.rs @@ -24,7 +24,7 @@ use kernel::{ bindings, error::Result, - ffi::{c_ulong, c_void}, + ffi::{c_int, c_ulong, c_void}, mm::{virt, Mm, MmWithUser}, new_mutex, new_spinlock, page::{Page, PAGE_SHIFT, PAGE_SIZE}, @@ -144,8 +144,17 @@ pub(crate) struct ShrinkablePageRange { _pin: PhantomPinned, } =20 -// We do not define any ops. For now, used only to check identity of vmas. -static BINDER_VM_OPS: AssertSync =3D Asser= tSync(pin_init::zeroed()); +unsafe extern "C" fn binder_mremap(_: *mut bindings::vm_area_struct) -> c_= int { + EINVAL.to_errno() +} + +static BINDER_VM_OPS: AssertSync =3D { + let ops =3D bindings::vm_operations_struct { + mremap: Some(binder_mremap), + ..pin_init::zeroed() + }; + AssertSync(ops) +}; =20 // To ensure that we do not accidentally install pages into or zap pages f= rom the wrong vma, we // check its vm_ops and private data before using it. --=20 2.55.0.897.gb25b4bd76c-goog