This is a follow up series fixing some pre-existing issues found by
sashiko during a review of an unrelated patchset here:
https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@google.com

The goal is to safely reject mremap() requests on binder's vma to
prevent pages from temporary leaking and accidental IPC tear-down.

--
v3:
 - Switch to a range-check in vm_ops->close() and protect against
   partial munmap() as Sashiko points out.

v2:
 - Set VM_DONTEXPAND in [1/5] and [2/5] per Sashiko's feedback.
 - Check vma->vm_start to prevent incorrect ->close() in [3/5] per
   Sashiko's feedback.
https://lore.kernel.org/all/20260901030419.470246-1-cmllamas@google.com/

v1:
https://lore.kernel.org/all/20260831224145.169403-1-cmllamas@google.com/

Carlos Llamas (5):
  binder: set VM_DONTEXPAND
  rust_binder: set VM_DONTEXPAND
  binder: check vma->vm_start in binder_vma_close()
  binder: reject mremap()
  rust_binder: reject mremap()

 drivers/android/binder.c             | 13 ++++++++++++-
 drivers/android/binder/page_range.rs | 15 ++++++++++++---
 drivers/android/binder/process.rs    |  1 +
 3 files changed, 25 insertions(+), 4 deletions(-)

-- 
2.55.0.966.g6673acef38-goog

On Tue, Sep 01, 2026 at 04:35:13PM +0000, Carlos Llamas wrote:
> This is a follow up series fixing some pre-existing issues found by
> sashiko during a review of an unrelated patchset here:
> https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@google.com
> 
> The goal is to safely reject mremap() requests on binder's vma to
> prevent pages from temporary leaking and accidental IPC tear-down.
> 
> --

Dang! Sashiko keeps finding pre-existing issues. AFAICT, all these are
real issues. It's seems we also, need to reject partial range munmap().
This should be easy though via ->may_split().

I'll send out a v4 with this addition.
--
Carlos Llamas