From nobody Sat Sep 26 16:40:14 2026 Received: from mail-pj1-f70.google.com (mail-pj1-f70.google.com [209.85.216.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51125480DF0 for ; Tue, 1 Sep 2026 16:35:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280528; cv=none; b=NOHlyskh1wpzLEID5Coi/V/6JmZgfzLc93Rdm0HsBZspevxvBWv42Vog8IoaJkGLeSVB54wONabbeScTgLu8FhC657yCl5QZaSrRLZzXF6clyZDzUDUQkgRJQuAp6gCfAi/uZP8Z2NEBJRPycIXb/hkgPr4ccpRHQGOM3FB2rrU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280528; c=relaxed/simple; bh=Ef4BVBI7qGDPlNFCmdIJj76ArTzSGUBqsa9qjOr7AUQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=ug+keLvbAkCBS0WZWlUlmH1UsDpal/Xnu2yZL+f+IKC7reVDM9D2ak2SQHqL6Un0VeX4tIkn1Ks6ySEr2ZdUr6W09msq9Rq2Knms1cqf8PeAEfVeOsX8YhomB0/88aHNqTPRVEWDnvyv6tJ6ObymIJtZXrrHPOcd2IeMl7qppnA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=BnQiAAaA; arc=none smtp.client-ip=209.85.216.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="BnQiAAaA" Received: by mail-pj1-f70.google.com with SMTP id 98e67ed59e1d1-38f5ac7416eso1441a91.3 for ; Tue, 01 Sep 2026 09:35:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788280526; x=1788885326; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=fOQzO1BwLqdJ6VWVJ7Bsn3PX5GscE0Esr+/b/xerP4U=; b=BnQiAAaAfm9xU//FEf50iWunOo7QUkAgkuNhscgqwapFJNDvFUSomFLngiA5RW2egT Pfgw4hQwPQPPmIwnQNMTf18839G0rRadDnVEnhyua11vfmuEwnUAlTX9KVe3dY1QIevR /q6OvSlGyIPJeTHm9zy6e+JFGEooJ5BFzpLG3Cz3J4fsJpwpt972QceSmtkAvznCvNfF dC7I3Xc1j4WAkT85gEK19fUzpbjHuF2gnDFZyezQhSSGlPyd3Q2ntOxQd4EwY03Vlnby SnYAmASRiFv278F9MM3s/oc3xlOvc3rdkonpubh1E4RhjXgq6Ku5vTo03uLHfndyKapZ BsFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280526; x=1788885326; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fOQzO1BwLqdJ6VWVJ7Bsn3PX5GscE0Esr+/b/xerP4U=; b=aqq/AFLEURzI2VXcVMp25oDmHv2ddG38ubuGVXRPb7u31Ia5FI8yKNdq6EzvAUwJTp dQmw25RkyYd9KfSCv+kj8mRaM06IxRWoEBXPfN23x7aOCrTgu/qVkveYPY6eXh5m4MJL EhKvH4DiR2/P39K8yO0mfDZKqFT5Y0YHC086u0ACs2DJm1y9zoYjTidYSL8NGQhZsgpC 0854a1lTuCNzKWu5+a1yvIOPSFv0Q7WPBS4yFjOZHAaWJrT3cFGRbpLesOVGlj7PnFup IEhuRCnnHo9d7tDorVqUqRtyS5npw/3s7pTREJZBFuR0r5FW0wuYdTvQHx7DW217fSXv WdFg== X-Forwarded-Encrypted: i=1; AKwUvBzyFmoctU5OR7+BpVCDnPHr6bRnzkD7RmNeWPJ0z3jUHSFDdlAEA7fKBAnE96/W30g6DLIH69qISQVX4Bo=@vger.kernel.org X-Gm-Message-State: AFuF++mxmkG4RuaniXqSNKmBOLFfBO3QNUQWv+1PZaBEs2sJm7G+a6XO B5f/zGPtTwCk4F1S7XMYPyIBnSvYUyZYdwFfY7mh3Iz9SorFWCQc3Vmvdha3AbmfwtWn99p1u2D ddeEV2jSEYrw5OA== X-Received: from dybsr39.prod.google.com ([2002:a05:7301:71a7:b0:328:ea0:399e]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:3ec1:b0:38e:7168:281 with SMTP id 98e67ed59e1d1-396d0f2dcd8mr41443991a91.10.1788280526175; Tue, 01 Sep 2026 09:35:26 -0700 (PDT) Date: Tue, 1 Sep 2026 16:35:14 +0000 In-Reply-To: <20260901163521.1355535-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901163521.1355535-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901163521.1355535-2-cmllamas@google.com> Subject: [PATCH v3 1/5] binder: set VM_DONTEXPAND From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support expanding VMAs. It caches the original size under alloc->buffer_size during mmap() and expanding the VMA would only result in a wasted virtual range. Set the VM_DONTEXPAND flag to prevent the vma from being expanded via mremap(). Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas%40g= oogle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 8f2ef1bd539f..1b492ed48ea6 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6056,7 +6056,8 @@ static int binder_mmap(struct file *filp, struct vm_a= rea_struct *vma) proc->pid, vma->vm_start, vma->vm_end, "bad vm_flags", -EPERM); return -EPERM; } - vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP, VM_MAYWRITE); + vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP | VM_DONTEXPAND, + VM_MAYWRITE); =20 vma->vm_ops =3D &binder_vm_ops; vma->vm_private_data =3D proc; --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 16:40:14 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8B45648124F for ; Tue, 1 Sep 2026 16:35:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280530; cv=none; b=s+Tn6u5/6CVyCsBw2Gt7m3+NDtW49hujv16+a/Ey/mr/3+cEiNZe3i/C4OtuLc+jF1/QC59dmspMkwnh55WDGPxUK0J9Var3q7Gbss87O3gzysOyAjtwNHYp8R22VghDZeM/Dggw1zncZS6qGV2HGwk38CCIKcTRx2pCUhEb/AE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280530; c=relaxed/simple; bh=Q3w+fqnn1Odo3u33vSDwy+efpfwvyQRtuduW7bjVVNs=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=tIfVE3/YjoWVxJ/ceWGqtot/qkgjMX1SxBtP8fK2PlOYBeoE4+IWX+idSoYG3K1So7jhQqGGdLz3Pw+HVoZDDAcwVAwfqQ4TfY3hnVjJVL/Fh2RqyvpmXUnzhAhVoz9vG2N/LxYlAPryA3aykeRDA5yfC2cevVn0SQuRnjp5NRs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=HTuJ2vnZ; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="HTuJ2vnZ" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-396901263b6so7014a91.2 for ; Tue, 01 Sep 2026 09:35:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788280528; x=1788885328; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=7ro8mTU0e+ibPxFysuMqboUdneRfJQUV4jga1NJ1RSo=; b=HTuJ2vnZM2PvqUN+B7/j4+UrD23gZi6rqd3NE7rQfapiv9TUd7LuExYrZcE4CZQLuY h1B5v2FIWotb3ZOlqRLooF/vtRVU/k/gSM6Yi+bMMhVrNSVJFllsJ14xBxuTLszMBPol s4Z8LtBxwBZcJDTYF1Ekly7lp6iRuLbGrU9s/sIPCxKz4Vn+Z3yQRJZYaKdOZWoW+Bxj reFrKGvYiKGT9DuFOoC/Fs5AeHq0naYS7TIv1VfDv+lzymyxjkYcGFa9xiq/igAH+xPm /Sokq98YWtziB2rG2KTSey/wwaFJnflhijx0G23Ky3ZY0LLbkz5A2HsNNk9T38GnQEYc +0iA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280528; x=1788885328; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7ro8mTU0e+ibPxFysuMqboUdneRfJQUV4jga1NJ1RSo=; b=IA2miIr6UU+5clxF+j0ybGgrAMhMSPgkZMdzJDOuFanFOUq77Ly6EmAee9zC4iD0qN NDAoDN2gLd6k66LkwrJVKrCn7odbRxuOziXTSPXt5KfjdJDQVYJa1Yi92OKOoVyx/4uh Nbt+IyZ/kP5wKv1NoQ5+yd3sxurSoIlpi/0/MX+F4nCbNPR7sH3nJQVjyFatDXQAteGT SoqUCXOzmDjg0RS2YgixOh1eusNMq9/JmwcJpGhpamJh7amOoBRR1UPWsDTISAvLNfl1 txpT2atlsWFOgYocoC/zQzb7hVS/0F3BM3ZtS8/QECToArT6YYt76gAmDNA0ZsziQSIv 7uvg== X-Forwarded-Encrypted: i=1; AKwUvByK8tVLvIHuRk2Xsh77i2adLQ8ByJfR5pgaNpsdjCuzUTkpYRX6oiXnRP7VGWbqRoIsBfHPGBNwHksKZY4=@vger.kernel.org X-Gm-Message-State: AFuF++lzYbs+ToJuDOoA2BvqMW+p21EsXv7KC7OSvq8W588jshkWXgUe mLMjtjmgaKqtw40l1fLynnwOjUWZMS2om2iMeXMEjMitf0JrmM2wUicWubkwqVIgyY7/ReByUaI Mfa1aJoE0ssp3ZQ== X-Received: from dlbro7.prod.google.com ([2002:a05:7022:1587:b0:141:4b64:a042]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:528f:b0:38e:9eb2:9d43 with SMTP id 98e67ed59e1d1-39907e113f5mr15291291a91.16.1788280527477; Tue, 01 Sep 2026 09:35:27 -0700 (PDT) Date: Tue, 1 Sep 2026 16:35:15 +0000 In-Reply-To: <20260901163521.1355535-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901163521.1355535-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901163521.1355535-3-cmllamas@google.com> Subject: [PATCH v3 2/5] rust_binder: set VM_DONTEXPAND From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support expanding VMAs. It uses the original size to create its RangeAllocator during mmap() and expanding the VMA would only result in a wasted virtual range. Set the VM_DONTEXPAND flag to prevent the vma from being expanded via mremap(). Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas%40g= oogle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder/process.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index 5372bfbd93b3..9038f3d13cfd 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1786,6 +1786,7 @@ pub(crate) fn mmap( vma.try_clear_maywrite().map_err(|_| EPERM)?; vma.set_dontcopy(); vma.set_mixedmap(); + vma.set_dontexpand(); =20 // TODO: Set ops. We need to learn when the user unmaps so that we= can stop using it. this.create_mapping(vma) --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 16:40:14 2026 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82B1948167D for ; Tue, 1 Sep 2026 16:35:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280530; cv=none; b=rKzDuDuiiT9bjIypIqXdQEB/V/+ELzzLTI9u4aX1yj0N1te4ezioMOCqUCcPZ/gw0rz9tkzY6Y+ZOmDOH10RHU/zOrUUnvyyl912bPpGdByAQjhUTpnTmL4kNRYRrW3u/7Iwmkr0br7y6V4r00LGCy8Uc+AMYps9FXwhXKGcixY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280530; c=relaxed/simple; bh=hu/IbFNnTPszKMIhPjq4a+4Cu+oiVtMDsWGda3p00DU=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=sdV39IkcD2KEIktlPOKCImMDY2hf+yqhD52RlxpPO+F7YEncYL1/ZFv4ntExiFKlXYbjhjmkoGYV8c5vRLUb1iIDeGv/UrgjcRPhMToWqIIes9lNUGmR5rsRM9NEl9+kpPaBCuuz5sJKs82q/C05HyujfsupH2d/LFz86tws5x4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=CvkihqJA; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="CvkihqJA" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cb6cf425e86so87115a12.1 for ; Tue, 01 Sep 2026 09:35:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788280529; x=1788885329; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=0uaVU7Y38geHLJxnPBb9TaaFKTDZvM/A8qN/l+64928=; b=CvkihqJA2qpPL1UQ3oJ6e7TAj4ayw/tKeAgNn9zMKeErFpN1j96lHfY4IOICZrpZb4 so12zVU5egPQmOfGMd9eSnfBu8cpYtSmW9BFFoq/JodeK0eHwBmwUfRilY9+WtNpfxUW hgqaokLnH83uzv9/pbFUQBGADgXjBLx28bCALvIM3slUJkx9lr6adeYUuEl7D7UlWU8T e/nnogtKR+BFCwtGU5sKlCs1oD/5uwlzyOjHvPRrWoY8uQgp7e+bs2FEHhOMBRRvxETJ 3FqA6Z4vSs3laeqiObIsx9YjVCAnKN3zF+m5t4EHWpXnI+bWUi4ot+H67HoCBA1TOyS7 erbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280529; x=1788885329; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=0uaVU7Y38geHLJxnPBb9TaaFKTDZvM/A8qN/l+64928=; b=VzTq6oNUgniyy+98mbPrkMTcY9YFaXeJ+WVcHD5xC7e2Q63ZvqBw+ArBZCZum1ZdSi VerIbXDTBu8cs1Ma4FPkj9ZpKMEvGR/KcIStutyTq7/AlMqQxl08JirqEz3729P/kSp2 btV6jHsSV36D5oAZTHReo4r6YRygQ8Ai2chF5RanJ1Kas276M01auO6kGolIhftETrM4 1tEtPWBDlvalcwdIcqwhuS8AAozv3waH2X8HTINYOKbZcZriDJTHPseuakSu3HvR0TfE PE1cmdlZ7ONcxID1zEJya6JSAKn+R1wO3N1f0ih4etcZn08P/BMT7RD14DDq8DlBXiV2 wWig== X-Forwarded-Encrypted: i=1; AKwUvByreYhfFFaoh67lmiRtvPa/Fh6NZyBi0Lfn3bwGpmpeleNv4vgRxIGWUMmjfiE67kmaCCeKDXg1Ty5GSb4=@vger.kernel.org X-Gm-Message-State: AFuF++m+2xepAted9TJcafr46PRLXMof8fMYAZn883yS4ypJzU9cX4hu 4l1XfnSBnrbNQx3BIrNsoOIShFzTmY8MjSarm/7ZHlZcw9kCs7n1K7XgX/uiHloYAfgL4X5o08C Z7r5PNzN0wN+erg== X-Received: from dybgt3.prod.google.com ([2002:a05:7301:2203:b0:327:d6cb:19b8]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:1e05:b0:398:9bd5:490c with SMTP id 98e67ed59e1d1-3989bd54c4emr33067004a91.19.1788280528732; Tue, 01 Sep 2026 09:35:28 -0700 (PDT) Date: Tue, 1 Sep 2026 16:35:16 +0000 In-Reply-To: <20260901163521.1355535-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901163521.1355535-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901163521.1355535-4-cmllamas@google.com> Subject: [PATCH v3 3/5] binder: check vma->vm_start in binder_vma_close() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Certain operations like a failed mremap() might trigger vm_ops->close() on temporary mappings. To avoid tearing-down the main binder mapping on these, let's verify that the VMA is within the expected address range. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas%40g= oogle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 1b492ed48ea6..59ff436f1138 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6018,6 +6018,10 @@ static void binder_vma_close(struct vm_area_struct *= vma) { struct binder_proc *proc =3D vma->vm_private_data; =20 + if (vma->vm_start < proc->alloc.vm_start || + vma->vm_start >=3D (proc->alloc.vm_start + proc->alloc.buffer_size)) + return; + binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 16:40:14 2026 Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D68B7483806 for ; Tue, 1 Sep 2026 16:35:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.69 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280532; cv=none; b=VLXphPDn176gATs54h1uVABBrh54Kkeme5SNDPE3JDmCF3UFlYWgc/EOfBo0ubqACzTLLMUaThtr+c50lJPOSJ94/GPwxfCgY0PDFYbuq5cjORpUmXr/YF9CpaNMyzC50aeyh4tAB0DYzfVOwYbq8fhOfAUEp/F3EmkBFBtaQ2E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280532; c=relaxed/simple; bh=GF/bVHokF5FXjZ+g0nsyqkLr5qbnoJSW65kdmui+Z90=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Qykww/XezP+ef157ZJGyBNzs75Nvfa4QxjWuW5ewTnzVPx1P0VLGQq8cH3mW/W8v4qrpxFfSCcG7Yg86JxSviBxQ5DqfHTUm6ov5pAjZ4dS2gavY4MP96xRgwfKHH4+sSNygAB5XBBbNVctYwZ7PDEI171XreuU/3C/hvVBFREQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=vnogmpqx; arc=none smtp.client-ip=209.85.216.69 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="vnogmpqx" Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-3965ba1ba3eso12432a91.2 for ; Tue, 01 Sep 2026 09:35:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788280530; x=1788885330; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=P1Px1YjhukNKpiGIzc6xWlYh1IDxs7EUGnftJx4GC/M=; b=vnogmpqxe/vBz7mSfzQ9Mq+0Uw9pn6X88u21weea1t8cmt6jd1l+KGl4/Ijp3rH+fm XrEP9nNPSk6wafORYRWwLoVLVzY8kdAqz7fsQP0eTgFfSfLtn8fdeoCo+f+jMOSlKxro xNtz4zjiK28aH8pKvf0tJ7dczE7W5CpcXS/vdSVzY/wBi63kO/Hjzy8P2hp9omN/HFyD ITrrRE5yWXqj+ny1BzbctPU/CCat043XCZ/ipoXaOb1xuyasAstocJV8FUBo7zYi8AkU 4FqI1ZZTwiEVDqbEp2k/3/ZwYWTQmZc4aDuDkp8cfyKKUljuJb7hQSIAeMHpQ38DHjNO BG4g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280530; x=1788885330; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=P1Px1YjhukNKpiGIzc6xWlYh1IDxs7EUGnftJx4GC/M=; b=BP2kUwIdFzW5E/fBXti4jpJBTTbV9PtwYIidTVoaulhYbWxejrIv59xLG3+//hO3Ai dTR5pbc3CzrTYcz18mxf8YZfJAPu22UIPHjR6uZ/ULIctbuUaaL4pfZfdL0/2F3Pxu3i 2vVIxlGhABlbu3wa+vk1rMAoKxDtgCTa0M3aK8vlQ7ZPrv00ulsZZbwSYFdIOEC+HOPv s6eQ0RERp9nLk7hhLm8NCU7LB2hbb5vu3uZ48Su5X2u26QYMwfAvAHM/WXrk2f8YOEBd rQgmc1StOsddZ3ASV1YokbDn4Kp5E88xlzp1g4wvNQXzY2R4roYWQ0aV8OGT8HGaKcmb gN3A== X-Forwarded-Encrypted: i=1; AKwUvBzVL5BAE/B96IUEe6IpP7TOCbrIPkEpp8iib1P6HNTt9MAxN3lgdyi6q1xQh3kPbsu2KyUNnSfXd1cSwIE=@vger.kernel.org X-Gm-Message-State: AFuF++l9Fh8Tqg+ZaGirDhFYlmkSLwti0fh/RP8brngogC/t3gX86XcL Zv08TkAcARiRbcvWbMc9T6Sz0kr8KZVpBTTaLeU5QaNWIvZX1cD7n2K2/B16N3fLucFpmwNCB4W KXaptbQ3+gd+zQQ== X-Received: from dybrx10.prod.google.com ([2002:a05:7301:4e8a:b0:314:f5d2:b3f3]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:5827:b0:381:11eb:d78e with SMTP id 98e67ed59e1d1-39907d6909fmr15493354a91.14.1788280529991; Tue, 01 Sep 2026 09:35:29 -0700 (PDT) Date: Tue, 1 Sep 2026 16:35:17 +0000 In-Reply-To: <20260901163521.1355535-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901163521.1355535-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901163521.1355535-5-cmllamas@google.com> Subject: [PATCH v3 4/5] binder: reject mremap() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support mremap() as it caches the mapping address in alloc->vm_start. Moving the mapping breaks the IPC communication for the process and can temporarily leak pages during a shrinker reclaim. Fix this by explicitly rejecting the .mremap() operation. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb%40go= ogle.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 59ff436f1138..0e6d6f6923d2 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6036,10 +6036,16 @@ VISIBLE_IF_KUNIT vm_fault_t binder_vm_fault(struct = vm_fault *vmf) } EXPORT_SYMBOL_IF_KUNIT(binder_vm_fault); =20 +static int binder_mremap(struct vm_area_struct *vma) +{ + return -EINVAL; +} + static const struct vm_operations_struct binder_vm_ops =3D { .open =3D binder_vma_open, .close =3D binder_vma_close, .fault =3D binder_vm_fault, + .mremap =3D binder_mremap, }; =20 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 16:40:14 2026 Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F2B248422F for ; Tue, 1 Sep 2026 16:35:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280534; cv=none; b=SOH8myuBB76dzaegA/ObPgbqsZgHw5UAV5J3qKoM3bO41sy8pueva9eLl8PqlaDlAWCzG4sxF/GcMxH1FSeOo04AiBsB/vTuN+MnZ2tdK7FPDGp4KIaKkz5vC2hrNiPE30c5SEn6qMysiQqxdrGA7daozk+wFCkbZh6UtVJU4eY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788280534; c=relaxed/simple; bh=xMfXa4JJaYVx9CY7Y6p7EK/bnTHLTV7vxrHNWHGqnw4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=L7g49fggVDUaJJ+NGUecdKvajTKTwmLaRCkF6EV3iYTzmBBJ/EitQ3qCy7rkbWHWfiSROjmQ+qm2ImMpFH1tsNtQojcwVo1txQ0m1yQ8cV8AW6KjthnJw5NesHMmW3nnYSdnHKq7olcgaBZqbxEDtEPWl5mkAkBxj3xf2ty7Nhc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=D5afQhUS; arc=none smtp.client-ip=209.85.216.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="D5afQhUS" Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-38e475f83a2so21690a91.1 for ; Tue, 01 Sep 2026 09:35:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788280532; x=1788885332; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KLMvfa5EimRkqQR6s886FTBUek6ludb5m9DiCXoQ59o=; b=D5afQhUSM5tSEqF5VeLaVVdHPhn14vTgeoQDIGVf9cY3mo1+mcw6SfROFMsNxsOYNi igXoHhQwYCb5+CngqmaFqmjtueUcHtZ7S0EcnvFUXBJelYkYu0vAhX29RRSEn4rV/iWS 3OSedlfAxJth/HgvP6dDshYQEhWaDAVPuFETkdIFv588O39+bn0aXXm1Ug2tME2K+Kkp TaUvb+Kaf37A3RDW9MntKAW2hQpCRSoirwiV4djgVS9Dk3wMktCTO/4tjsIXvIq14lni eeyEImBp3F2yteBP+FUgw127Za6tSQTnEHxVVHAV9QvoZZaItk5N9NNWZTg1UDNAmJWz A+RQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788280532; x=1788885332; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KLMvfa5EimRkqQR6s886FTBUek6ludb5m9DiCXoQ59o=; b=KrRnYwnhgnJdIc5p6+vX2SphEkeUQNPdD8ZkVOmXteaofQpyRteDXVzZK2jJziQboi /9g5xsK8Vw6dL7Vca5/aTVdCpsvxHnFml3B9+oMuMPAigsr3ueWbdgoGSe1hKofct8dc RnrrX8tFQ/DgW1PUAeaYjzx+uHAtg8ju7ZutLnXB6GJGmDfmEI4+VouQbMbpPHnIZOsz 6w8Svrv4THUsTroS/ZGI325r68waUSUenggIiWSL2fdvZnK68g+Jvm60DzqAt8KLesMA ITSsmtm08HCVikK2UqaIm4nLr7tjgY3zC1y+zeGqHG9SOFzwJwSx+kGOtbnW3olr7UwN mzNg== X-Forwarded-Encrypted: i=1; AKwUvBxz0vkZr7CebJsg1FCKV6cWrg81mfQV6fB8i7nlSKQftiUBcSv/w0hxZHec6Gub6BxPft5wWbIPQXgDykQ=@vger.kernel.org X-Gm-Message-State: AFuF++m8XISY9e/TTXM0RuzTVqoFGi0P23grxWQ7xqSEaHKR27XKfpmc Lw2J4+WHOSkcUqTqdooVwSbo7Utud3yX0EIN35VAn2fuEk6bytRrPFR4b+Qx0lRBBqW4PvRgxW2 eqG6qL8rvu1OBsg== X-Received: from dycna14.prod.google.com ([2002:a05:7300:ea8e:b0:328:665b:a9ce]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90a:d407:b0:398:e73e:5a13 with SMTP id 98e67ed59e1d1-39907bbe00cmr15099714a91.9.1788280531343; Tue, 01 Sep 2026 09:35:31 -0700 (PDT) Date: Tue, 1 Sep 2026 16:35:18 +0000 In-Reply-To: <20260901163521.1355535-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901163521.1355535-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901163521.1355535-6-cmllamas@google.com> Subject: [PATCH v3 5/5] rust_binder: reject mremap() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl , Benno Lossin , Gary Guo Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko , "open list:RUST [PIN-INIT]:Keyword:bpin-initb|pin_initb|PinInit" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support mremap() as it caches the mapping address in Inner::vma_addr. Moving the mapping breaks the IPC communication for the process and can temporarily leak pages during a shrinker reclaim. Fix this by explicitly rejecting the .mremap() operation. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb%40go= ogle.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder/page_range.rs | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/= page_range.rs index 52ffbf3504e7..411efcc2116f 100644 --- a/drivers/android/binder/page_range.rs +++ b/drivers/android/binder/page_range.rs @@ -24,7 +24,7 @@ use kernel::{ bindings, error::Result, - ffi::{c_ulong, c_void}, + ffi::{c_int, c_ulong, c_void}, mm::{virt, Mm, MmWithUser}, new_mutex, new_spinlock, page::{Page, PAGE_SHIFT, PAGE_SIZE}, @@ -144,8 +144,17 @@ pub(crate) struct ShrinkablePageRange { _pin: PhantomPinned, } =20 -// We do not define any ops. For now, used only to check identity of vmas. -static BINDER_VM_OPS: AssertSync =3D Asser= tSync(pin_init::zeroed()); +unsafe extern "C" fn binder_mremap(_: *mut bindings::vm_area_struct) -> c_= int { + EINVAL.to_errno() +} + +static BINDER_VM_OPS: AssertSync =3D { + let ops =3D bindings::vm_operations_struct { + mremap: Some(binder_mremap), + ..pin_init::zeroed() + }; + AssertSync(ops) +}; =20 // To ensure that we do not accidentally install pages into or zap pages f= rom the wrong vma, we // check its vm_ops and private data before using it. --=20 2.55.0.966.g6673acef38-goog