From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC61F466B63 for ; Tue, 1 Sep 2026 20:52:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295979; cv=none; b=G6ZfqjFl3RfFVtEWCuy4ZNzhr9nk0Zp3KpINFHKnW6Lr7aoHVdR98iu6+Igeg00ZdYPL2TKSvz4y/uqCwPmdoT15PPOUFz2qHYwEWhNTDdqnrxE6VJxg6wwOGn0BglUnf/2WsTTmxGxastk4r+jlLmmgFvtVE0FZ+zrVmaQVPzk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295979; c=relaxed/simple; bh=mC01VX1n7muqMaBoWw5J7zX+JcinZQb0IpbAjZAJoWg=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=rknok9jL1qrC9hVzsbZ5L/5IF4RlEeryx2hnc5mqmsCst5+Faq7HiGM85+uyzc/8P9gvfgRLBtPuZU/grJEjcDV+IfD5HfEXL7GyLVhXB+/OEyJk8mvHu6mvxPFh6iBsNzckwLsPWEmDaN3naF9ASg7D/ofLr6nCURvFOWKxvWc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=MQzoiVT1; arc=none smtp.client-ip=209.85.215.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="MQzoiVT1" Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-cbedbd182f5so234383a12.1 for ; Tue, 01 Sep 2026 13:52:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295976; x=1788900776; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=zocSb9A1qfC5TL5NRNiwUw0+UxJIZxHTRhrF7BbbrB0=; b=MQzoiVT1Y2bEl7t4/tMFXOGz6gcgV9h6I/ENOIWVQy289NffZqaVD3bcSnc7m/PvLH v7EaHE6WGvYhDxZx8pii+XxhOiOeeCSKxjkXvE7DYk40JoQjdrY8S4vauo8V52B3DKkU iMs4QJ8njowrYRwpRNzbPQKHmwFLvPO0XgFQOyWMXsPMF7trE4GzbgD3IxUvECraUHuO 3XCS1jXGjPlX9NBTBYoN6SLlVY/olUA0mS8sxvkYyXU0zTrsjpH1F2/gLRbTELOzHUvS QtzhPaLy5Fv8T8c7kN1LznZAXG6XJA7jgDaoVjwhkQghIF0uVTx/VLs7ymPhSFMyuHGb 5HYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295976; x=1788900776; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=zocSb9A1qfC5TL5NRNiwUw0+UxJIZxHTRhrF7BbbrB0=; b=bwbMeXSShwt4im7CfFNzbB78dQQuoACFkG41O0w9E4jaAHEmHgxzCQTSWlw1vbmOmk B2rgbgF37xlwx1/VfARiBRVrIW1S6O9zoBF9AXBTXZeMW0rKgkH0Qjk09VMXvY/ddNoO bpJ/pmdsugRALCvqFqW28eBjr7PaMck60P0I4JB1Ph+iNJtMKAUWwPq82BTEC39AKRrw XV2jDTLGuYbobS3KYj2/aF0sNXB7aB95g+4RpnYw1OEzonlVhUcH90syDP8NDndEtQuI HKvH5xnbQ21IAQwzmeb/Ht5Rh76IbQOd/XNtgomWhr8yINq3Mr2Rpl9ZXQkaBMW5Dfbo SncA== X-Forwarded-Encrypted: i=1; AKwUvBw3eFMEqxrMyZl2Fud0xdoRRC0XuhlR/XAJ46WTSII5Vaz7bvUqiok+EBDWy0ofuTMcP7D+aoGvEun7jUA=@vger.kernel.org X-Gm-Message-State: AFuF++m2U4nTbn9etM3e1hiDNS+a5ZI1ki+vPEDslI8VK1ZDMVnS9/45 xiOHYOvKbxET5Yjaz92MEFuEDeA18inbieVjxJIpgBxoHRQi5X41zlM4QUKUbqcusdwxEf5NsP2 r7JsjJtwJUvKeHA== X-Received: from dybla10.prod.google.com ([2002:a05:7301:1a8a:b0:32e:7e7e:22ff]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:2410:b0:2d9:2b1b:878a with SMTP id d9443c01a7336-2d9526c2cdfmr76986075ad.10.1788295976098; Tue, 01 Sep 2026 13:52:56 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:41 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-2-cmllamas@google.com> Subject: [PATCH v4 1/7] binder: set VM_DONTEXPAND From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support expanding VMAs. It caches the original size under alloc->buffer_size during mmap() and expanding the VMA would only result in a wasted virtual range. Set the VM_DONTEXPAND flag to prevent the vma from being expanded via mremap(). Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas@goo= gle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 8f2ef1bd539f..1b492ed48ea6 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6056,7 +6056,8 @@ static int binder_mmap(struct file *filp, struct vm_a= rea_struct *vma) proc->pid, vma->vm_start, vma->vm_end, "bad vm_flags", -EPERM); return -EPERM; } - vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP, VM_MAYWRITE); + vm_flags_mod(vma, VM_DONTCOPY | VM_MIXEDMAP | VM_DONTEXPAND, + VM_MAYWRITE); =20 vma->vm_ops =3D &binder_vm_ops; vma->vm_private_data =3D proc; --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pj1-f72.google.com (mail-pj1-f72.google.com [209.85.216.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F1454A3F2A for ; Tue, 1 Sep 2026 20:52:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295979; cv=none; b=KIpYtsHdvOSHHae/kgBwlOt1Wfkm/RhakuVgVRZfRUeGPLN3KF9tZVPXo0SrsB0VNh8XL6pewxFOcmy147BNVD/4pO+/JjlTPNwcch4WI2RnwQTZj6k18WwedqepGdWTs/U2SZp4N9Pe307Uc6WbcWM1oBTruGrJ/qoazob4BVI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295979; c=relaxed/simple; bh=qDxPPBiVzVIZg0bueYBv9GJ3dcl74Eqh6LmL3sW7by4=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=NbV65+LDwPK2922Q/2utGAXL9DmRr0icY11etdLVfCxY6GMRXMrZhRFV+euSaNwXZajLM4i8EN457/3wQKMaxxu/X2P0WQDyUuid8ohUaxkkocM2OFODFOLezPD2HXgqOZTMse6RItAaMvm5pQWDrwrIrT4LSGfrHMJzFbptktQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=uZzhFoVv; arc=none smtp.client-ip=209.85.216.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="uZzhFoVv" Received: by mail-pj1-f72.google.com with SMTP id 98e67ed59e1d1-396b9ef3070so448761a91.3 for ; Tue, 01 Sep 2026 13:52:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295977; x=1788900777; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=B4b9RJf/EoA9UAqTMJZs0pdFOLSykyAl2dSQSlyCXCk=; b=uZzhFoVvpFCQobtS2UZP/oJw6haDPgYW9kzWBA+S3a95dxlXmftJOubUvKjx/NmYDc CBvtwOQ7j9FJENsql8oqdMmdugkkY89Axo/B+CFYOx8kTF2YvQo7XhyRUIt8LPiu0nO/ e0kz+cAZpYcnS7+lbeVoqxf6qgjgxdb3ltVY4vDXr4f40Tqf5vrnUAi7SK3dA5G3DAdd Wx0ShhkxXDyte5R9NInT8KIGesb5ihZcWgZ7dBTGvUVVg3mWc8SAUT1TRLESp4tbsuZh HAXvSgdqE8ug4v5O2cS5hS4jJWAEcNZY/tBv6K3yhMyNYS6IWFjiDJEbsQ0R1tgxM5a0 SJWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295977; x=1788900777; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=B4b9RJf/EoA9UAqTMJZs0pdFOLSykyAl2dSQSlyCXCk=; b=OMyWj1tRiELadBVkIQ7liyG41XZrTf5tvUdtGx4/i27Bz7cWJSnmBZsvfLBW8uHq0D 9Nm25acAZ9CTav9wQC5l5h5f8N2krKhHyF+7hN3ekHFIDzIokY1k84fuV4VZhG5sFnOQ n1zOQNT+5xnv+t4WyuOQ/hRKXcWdU6PI0Nr4kkpdtqJN4h2BA8khL9zSk5uNQxvHdYem a1615RGJMrnm0Mucstjy33KBzYhoL1U0H2SJe/cNYtCLU1XlZ/8zncSdyWDk60h0ztKB pJM7o5UYVPBoErOkTG1Fr5O0dRsd9Bj7UK1W8DzX2JKIic0zRIeyNm3RCkxpV87ZylGG T3ig== X-Forwarded-Encrypted: i=1; AKwUvBwA5dzVnQefTPwsfV/IYBiiIix0wpzF7VtbWTvfZV+BaERIu9127RDzv6gfZ31MhC5cmiLl46tf8gxcMks=@vger.kernel.org X-Gm-Message-State: AFuF++l9p+GNmJ0yzJeVpPFlBkKjgHRwMP7iz19kvS4KXr69UQOas0Cp /1mdylI4USDx6tJ0wa45HPxFHaKN6WhkjxUiEStAEqIokeiNFGJO+jt2IU/db6zTywZYYlatZEk dSYcpkJTOO4Xt2A== X-Received: from dltt5.prod.google.com ([2002:a05:701a:c965:b0:141:a317:d828]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:3903:b0:398:ba96:1afd with SMTP id 98e67ed59e1d1-39907bbe018mr15277088a91.8.1788295977354; Tue, 01 Sep 2026 13:52:57 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:42 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-3-cmllamas@google.com> Subject: [PATCH v4 2/7] rust_binder: set VM_DONTEXPAND From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support expanding VMAs. It uses the original size to create its RangeAllocator during mmap() and expanding the VMA would only result in a wasted virtual range. Set the VM_DONTEXPAND flag to prevent the vma from being expanded via mremap(). Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas@goo= gle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder/process.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/pro= cess.rs index 5372bfbd93b3..9038f3d13cfd 100644 --- a/drivers/android/binder/process.rs +++ b/drivers/android/binder/process.rs @@ -1786,6 +1786,7 @@ pub(crate) fn mmap( vma.try_clear_maywrite().map_err(|_| EPERM)?; vma.set_dontcopy(); vma.set_mixedmap(); + vma.set_dontexpand(); =20 // TODO: Set ops. We need to learn when the user unmaps so that we= can stop using it. this.create_mapping(vma) --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4CA234A482E for ; Tue, 1 Sep 2026 20:53:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.71 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295981; cv=none; b=g3tsXachQje0rpAOwy1j/PCeD8CQJjoDYxiDaouoNOtb+CqY71149YKlMF1IIC0QmztB7yfB5BX8BaI3dfrx7sms2Isw+KeUkz92+FVlAo9MVq1CDPAul3b3WM0gR89LQ4utc0Jd/QkcOjfuik937dcPKIRd/BEKgf/Gl5h+r5Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295981; c=relaxed/simple; bh=GPmeVGMLIoZoIlDJwvRRrzHCCviiWSVdzdWd0kwp7eo=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=MgUsEwz0170ac5DQaHt8BavX+/XZfZWkWj13uW24uQFW8edEYxqiQzHUcSR9oxJW4QorRt2VRrPxlTcNOu3xtILIsFX1Tb3teMHyFxu7Lxg5lOIJrsk/5VNKl039FW3PWZnttyDot3QWEYutSlSur8Lph3s3z4HqmATq9ylfu5U= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=Tu6nODk1; arc=none smtp.client-ip=209.85.216.71 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="Tu6nODk1" Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-38e475f83a2so434016a91.1 for ; Tue, 01 Sep 2026 13:53:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295980; x=1788900780; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=efterSwzpT8WmqwjvTJaX4ZNpH8DVSU8cX8allgguTQ=; b=Tu6nODk1QBxWhrKm1cNl2rhTHsDwbv1JAVnun7jGvgkKnXwo6iCZsA+CRGU+162hpx G48bzgokgKMMFw35fPZ2AlYEYLMuIDJIhBtyfabbrnzjXeAb0GFyL4NTrf19RWysADxH siRLBPpS4IajYwow+JTfRgeXmPoDnTcXGvB/DYHawzJRaqsAIloKkS8PyZ4ROEcJHsNZ gBArKJLo4z/MInYR/CHbYndagVacrYyj6omyFMqjsJC9b7kTTrstlAyJv5n897sjzauS EhfCW6GSsm+VuGePYK1fp+RovXu/7ivGW1AevykMUkRyTMT9Vwag75rIUL4eupL1YHeQ RqdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295980; x=1788900780; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=efterSwzpT8WmqwjvTJaX4ZNpH8DVSU8cX8allgguTQ=; b=dKq13DNum2ozU4CfkuC+U8/Cj5AwkQAb0xVnHkGQ3BX7/UKerCTiWxxC1gpo00mRpy JIBrOpB1GI/YJ6ok1UZGvwFaMnLIG38+KsRNkKV0gxyFMjw3aFfxEsVudF0cUoW1jJBk b1iTip0CLzaj479Vki8QGSyG923AvnH3POdaM3IhT/OCupeVrVve91YfwdECczyDn+E0 WKO9vJTSL5EW7YR5kurMPTSoVsAx+sVkONlY4X3zP4D12CAe1/xefo1VzIIjsg95J1nn /tntaYE+gC11V1kbhvc/g7l0XE1eNqW/uLH7XtsbFPNVXXbB9iZFbZq9UEPk0eIyITyL kxdA== X-Forwarded-Encrypted: i=1; AKwUvBy2pC15MlY8sArTIiFQXDy2Z3WB8gIDeXLMWtHOHqDIhotZHUgMxnPyOKnSanxrEYxYxARJSp2y53REoQo=@vger.kernel.org X-Gm-Message-State: AFuF++lqRKNGJ6SHa94xlOwNOkLFohbOhGp6CBGPYZJSVyy40qh15GhM Zk7zh/sS7jq+SWQBwHuwjszvpI6YN6Zp0HZe0s3dKeRICtpOLQcmd9ZN2dgTqqfx4VxtCxV1be5 v/E6rlSrAaIfHLQ== X-Received: from dld23.prod.google.com ([2002:a05:7022:317:b0:13b:9d65:a542]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:394c:b0:398:9bd4:d12 with SMTP id 98e67ed59e1d1-39907e4ada0mr17485453a91.17.1788295978602; Tue, 01 Sep 2026 13:52:58 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:43 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-4-cmllamas@google.com> Subject: [PATCH v4 3/7] binder: forbid vma splitting From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support splitting its mappings. Allowing so, leads to potential attacks that stem from a partial munmap(), such as closing the tail range and replacing it with a new mapping. Close the loophole by explicitly rejecting vma splitting. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260901163521.1355535-1-cmllamas@go= ogle.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 1b492ed48ea6..185128577829 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6032,10 +6032,16 @@ VISIBLE_IF_KUNIT vm_fault_t binder_vm_fault(struct = vm_fault *vmf) } EXPORT_SYMBOL_IF_KUNIT(binder_vm_fault); =20 +static int binder_vma_may_split(struct vm_area_struct *vma, unsigned long = addr) +{ + return -EINVAL; +} + static const struct vm_operations_struct binder_vm_ops =3D { .open =3D binder_vma_open, .close =3D binder_vma_close, .fault =3D binder_vm_fault, + .may_split =3D binder_vma_may_split, }; =20 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9CA374A440A for ; Tue, 1 Sep 2026 20:53:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295982; cv=none; b=fpZ5ua5oyaVPYfJbfccylR3C6kFK2o2TNUZ3Q4du5Ay4lvmgDk/BcbXNzg7vm9jGYQxndoH/C+kjkPDrYnjX79iMw3KVSQKnCWW1PC41w7aOZQjqanovxYAbwR/PcH+rLXqUG3mcqA1xfHzi21r04YHsM4u8l1zmFJ34ujkHS5c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295982; c=relaxed/simple; bh=8YxYBVKp4QC6MS58T6jznUoadNYscBAXK9umwSVzAlk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=ihixsoJyFb9S3bCZoQaFQsIIuMrrEGxX0/wCZqQE8w83FZiGuWI7yqrNSOlaTnqOY/3Lextzh/n7C00NCsyCV04jFKCwOWu//8g/4u5YNW+J+NP0ouEt+LfqSsE0dbfbKiQW5b/TNDB5nrTiKuOzF2Hn8qfY3MTNljJjBjWwvPQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=g6jEOv98; arc=none smtp.client-ip=209.85.214.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="g6jEOv98" Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2cf7dd9fd91so2287405ad.1 for ; Tue, 01 Sep 2026 13:53:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295980; x=1788900780; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=WWyWDWfLZFwic6F4ZvVl11QlqA6Vmuy0wQNwElQAh38=; b=g6jEOv98s7WACaPPo0Hi3snTyvFMOmljYiq7Q1vAkX/DOnCijmTlfhpyAgksagCWeE vnpnk2SPP4r+k+9Jibobb5ApoSfQG/Org1KTLdRJyc1/fR58qXIKBsYO8SwuGnk3VwrT twNm5x+q/9KQ4cDmM8ihv0lSkFWZrKSiyGm73BkhykKg7SiK78BGTs6KPuOSVcnVwELV g6deda675qu4KpUAk2WZPOZURYXZhCy7QT9oNbVYFLLHj9SVQ2Y6aOjs+Ltl0wLPeCJT iNkVAIzDjvJMYxcoifu+UvOZ3OQ4Ma3CBcsRC1Hpsi2cijCI3tJaQelNT86LbnL+bzKf S4tA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295980; x=1788900780; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WWyWDWfLZFwic6F4ZvVl11QlqA6Vmuy0wQNwElQAh38=; b=rfu8IIohS6w2HkkAxkGy1KdMgyG/qFmLjKp/i2zx1UzX5eZkY6q3xv2YgzPvqLASqC ZdjxmytcgWKjG4QGsoFLqiU9F39T77O/by/5/t6sZ/Q8s6dLFOQ2JfksL6FN/eK/0yva VRzUS40yfaPNsk8qStl4lxdnBkuSN3UDNvL6YEPZ0cpZPkLiKeUtZi6iAg4hpRyBPjrb qV++Duy/B2KZ3MNJOt1HULAXnWGuFuR4VHmpOriuHHLIhpmKGspcgOGJ+gIbZWc7hRsK 6C11k+XEsj13qnkb/51k/QEx5bVDcdUHsqnmrTdsDhn8T4x4GxQ8qBxxrX7W6R0vX2wW TWig== X-Forwarded-Encrypted: i=1; AKwUvBz8KSAlXGb05xSf+7qqLe3lJOMGi3FLtNAR/dKySVVnqz6RL1W5sg7/FrtQERVR5ErO5udRDQ6GHrWNx7U=@vger.kernel.org X-Gm-Message-State: AFuF++neoKq//mCSo+1jtxJvxiiImwOQgbyL684GIkTVtd8ZiHEFfmLA K8RM+SuOwc6n3nTKLX7N4moiJdLHiICN/cCeYAVbg4rbtK2sktQTHevf/EUcICHmY6cTTTrHaSF MUQ8n+8F62rY81g== X-Received: from dyw18.prod.google.com ([2002:a05:7300:8812:b0:328:4817:a473]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:903:11c8:b0:2d9:26b3:547 with SMTP id d9443c01a7336-2d926b30c76mr207766345ad.20.1788295979822; Tue, 01 Sep 2026 13:52:59 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:44 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-5-cmllamas@google.com> Subject: [PATCH v4 4/7] rust_binder: forbid vma splitting From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl , Benno Lossin , Gary Guo Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko , "open list:RUST [PIN-INIT]:Keyword:bpin-initb|pin_initb|PinInit" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support splitting its mappings. Allowing so, leads to potential attacks that stem from a partial munmap(), such as closing the tail range and replacing it with a new mapping. Close the loophole by explicitly rejecting vma splitting. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260901163521.1355535-1-cmllamas@go= ogle.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder/page_range.rs | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/= page_range.rs index 52ffbf3504e7..d260b009c184 100644 --- a/drivers/android/binder/page_range.rs +++ b/drivers/android/binder/page_range.rs @@ -24,7 +24,7 @@ use kernel::{ bindings, error::Result, - ffi::{c_ulong, c_void}, + ffi::{c_int, c_ulong, c_void}, mm::{virt, Mm, MmWithUser}, new_mutex, new_spinlock, page::{Page, PAGE_SHIFT, PAGE_SIZE}, @@ -144,8 +144,17 @@ pub(crate) struct ShrinkablePageRange { _pin: PhantomPinned, } =20 -// We do not define any ops. For now, used only to check identity of vmas. -static BINDER_VM_OPS: AssertSync =3D Asser= tSync(pin_init::zeroed()); +unsafe extern "C" fn binder_vma_may_split(_: *mut bindings::vm_area_struct= , _: c_ulong) -> c_int { + EINVAL.to_errno() +} + +static BINDER_VM_OPS: AssertSync =3D { + let ops =3D bindings::vm_operations_struct { + may_split: Some(binder_vma_may_split), + ..pin_init::zeroed() + }; + AssertSync(ops) +}; =20 // To ensure that we do not accidentally install pages into or zap pages f= rom the wrong vma, we // check its vm_ops and private data before using it. --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EEDB14A482F for ; Tue, 1 Sep 2026 20:53:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295983; cv=none; b=q1o1HGJ8dUIc4yuqlEAlQoG1TmCpTTSMk6gvNJeiflPN1/19pGVKFPnOQMOP/0wzpkXdkUtPn1snpnkgMSR5P5JKWJcLcI5qSwAIboYmHpTQ7Liwqn5nmBXtWX2D3/GE/qlWPxdoXATovx6X/xgeLDA/iwXa0Nei7P1YR9cX4QA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295983; c=relaxed/simple; bh=C+SBGaTzz9NM7jGZ23XHiP5B/G0nfL/GkCZ+fXA5IEU=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=eiVp0EJUOkuy3iP2FrrZQ8VXqFzGC76a1vC2ZjOQ6L7mztbuYBUix/PLrBz/Vjs/swmmcsfHEIKbH9uzQWLZArOoHW515HSEVbbtwdZ17pTe2OnRdpK70UKzSStGxZfUYhMmeFxPwhBVpFl/4eIpcrwYtF7PfK3lRC5QjBmsBDM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=O61lGwuv; arc=none smtp.client-ip=209.85.214.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="O61lGwuv" Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2d7293f13c6so2849415ad.2 for ; Tue, 01 Sep 2026 13:53:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295981; x=1788900781; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=93eGEgj74rp1RcZzJal7clwlrfi0gvUnBoc2ODTBoCo=; b=O61lGwuvZJQwiyoxcV8GC9M8bbmCLk8G3bstG9hgL9JPQ1yW4Si7Do36sk88ipP/4p gdtgBRbobD/aukaXtypoqk0dYBerFqW0wB58hQEHQ4ONQtWZbMSoApLHn8UDU0O4vHWu bRaop54VJa+NZSrFPuOHE+h5xjDgbJ4WrsqCcXsXD1475V1eBoE/w2kt1TtLauGS+uaG 3UaME2voCa9H69z+p0dJ6EzsCFBE5yEezyzPaHaOSsukhaLJIfWwm3OvUgXJzuklbmaJ qai7WMdC/dIgHbFC1LpxjCSptoVzpYKxoABhrlHvtFW4sSboyiFi2JDOZn569oq5oQEP CNiA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295981; x=1788900781; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=93eGEgj74rp1RcZzJal7clwlrfi0gvUnBoc2ODTBoCo=; b=JXGFBa+q0OnujvRAvcqlBTSEg5pAKgBflV+BYYNyQlcy0PnzKRHH388lF0eIaJXIel ROPqo5zbsI2RdP+m6ZCPt9cRSlXn70zKaT4dUciVVeTiqbDNBjmPRSzyu0a4+w4iODrq ZWyu2VpMomNbM1C65Cg2O1aITf9Ax2JyYAafZPPdrGDni8jhzga+WpWemnAcgOcKoBGx C7p6Lx2wjzo3Wj89Oj96No/QoatSc857Pr5BF0BQdUDb7CxMrJtaoZiOycKqnkYR0AuP 6wvXlfCzjr6GcUpouQP3/3WsO3avFM2H068A2bgNd6JDcaDZttmYMoDXdYinlT+4E0cK /vrg== X-Forwarded-Encrypted: i=1; AKwUvBwe1SEjQcCfR1+MexfrYtgv3E9GvEUYIy+VioRHnIngNECQP9L3GwGzrPr/ZbXD5gZC3IPx55j9zu1wKMs=@vger.kernel.org X-Gm-Message-State: AFuF++kyNyWUM/May04ZJICLe5TnxBUuwClpWJhSn9yOndLxk1Xt0pwe vOvsQ6qiz1/XOuLoC9jga24GnIDgDvvwbT/Q3j6NP2DZf1U9P7V0f8gGUM7qmz3AuwEEeaHzNID fBNybWwRIA6IKxQ== X-Received: from dybts15.prod.google.com ([2002:a05:7300:f58f:b0:32e:3955:bc8d]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:ef0f:b0:2d6:df31:5bd0 with SMTP id d9443c01a7336-2d94a8e0d02mr151856255ad.10.1788295981024; Tue, 01 Sep 2026 13:53:01 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:45 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-6-cmllamas@google.com> Subject: [PATCH v4 5/7] binder: check vma->vm_start in binder_vma_close() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Certain operations like a failed mremap() might trigger vm_ops->close() on temporary mappings. To avoid tearing-down the main binder mapping on these, let's verify that the VMA matches the expected starting address. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831224145.169403-1-cmllamas@goo= gle.com?part=3D1 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 185128577829..3d359490436e 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6018,6 +6018,9 @@ static void binder_vma_close(struct vm_area_struct *v= ma) { struct binder_proc *proc =3D vma->vm_private_data; =20 + if (vma->vm_start !=3D proc->alloc.vm_start) + return; + binder_debug(BINDER_DEBUG_OPEN_CLOSE, "%d close vm area %lx-%lx (%ld K) vma %lx pagep %lx\n", proc->pid, vma->vm_start, vma->vm_end, --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 49E654A4989 for ; Tue, 1 Sep 2026 20:53:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295984; cv=none; b=b9d3/ok0jcpqewiuiQbnPSJJUr86jz8tBW4PKFuzQvXBLGRQhQmr/9woS00r+PbmmRpVYS/O0lKiENJmEWfLOXc9ZQDwzcXoIAiF7XV7tfO8K0utweWJUXJ2X2MBIdaB5iP27TBPdt9u+lfoQywn5d2wZPCugzzUxp9YngbUqrk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295984; c=relaxed/simple; bh=/gMq7w6xSnPLzuoQSCSqsUxsfxg4kXXouj2VF8DdqoQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=skY+TQ88bpiBYUkG2MYfBoq3mWeUSTbYIS4XwLu3OMs7Z/xoxLoo9GO+DBigf1iPAEKhrAdqbI/IjQwfTXuYNXLu5LSgQuDHv/JJVF6NTR724Lm3bGYjwCZAvY4HaeLj+onC9R9eyKUdhbjrxQPpYklLDvbxtK+ncuzhV6WH7VY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=f8931WG3; arc=none smtp.client-ip=209.85.214.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="f8931WG3" Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2cfe48ca1efso2971135ad.0 for ; Tue, 01 Sep 2026 13:53:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295982; x=1788900782; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=11XYeOadEK/aHTk3U1zKkiikckIvd/a0F9zap2SHnBg=; b=f8931WG3klFJfJqJonM45DVGjKgCo1+14iY8P4AU3WAZ5oi0FYAj28QlcFG8DdOEbL HKtqp/9fY92mdpcmsDyr33+FhjyHrZq+95mesrXaYx7Y9wDcszQ+9c0fu9F10UZhf+e2 rnelhqtQnxqTw/ZghSM+1di8Ob7xh2nYJ3YH9RkpeEl3P4YfApnDyVZxGZpx/G8+INC4 kvTy9NL1p9prRMoGRj6cQw3FZvdjzk7pQ6DoE9rmwThNEB0jFmpLLRWElzPiRVtHm1F/ RIeOPPX2rWhKKUmc1KL9yG20ZIMx578ShIPiQBvFnE0JIcn9QhMEp4awqpUv4vzjW1qo lt5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295982; x=1788900782; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=11XYeOadEK/aHTk3U1zKkiikckIvd/a0F9zap2SHnBg=; b=L+Aa9e/RdrxfMLEYgk5Hl22pXZWlBz+hDYcHtG3eSXxZhUNzLj13uhR7N0RoWb2K3A rdUyKpWOpTEx8YrUF2Qz+63DHiaG5g66wx7cvxkV6ds4FFZPGUT5LvInLwAo3lbSD8jx wP3/mIc1YG93dnSEDdoCyMI4esKz4aV/CutZXaKfXYf5sXthyoxJ965C7JmcPu8Yf/re ZL0TaKo5vfdZmO3kbcwLKlPobDQf6TOouBiKL4prgOLKZUK3vPbSjL0WFWc/qx+Hml+M uvsx/0PnI4RRvDUU0zkI7FQMByvvScmOz0Oe/qs3bQ2GtRyxKT0hoNNcb5UrMuG9RdKl T/yQ== X-Forwarded-Encrypted: i=1; AKwUvBzLzGvBlHTp+d54FFHPTigJntm4Lvv0H9hmu1mf+21nsa3ABaNiuD5qjw8nZ5FB/sQ3BtzqHItVY47OISM=@vger.kernel.org X-Gm-Message-State: AFuF++mCTM5kXt0eUWGZpbBJ2ZXNfm2mAY/1DNs4YDD+Hh4F5Jy9lFQS sCLIIB88NFmneKMT3Q8y1jZbrdjMJjVptC2yb0o2QickCtDyl1rPIUDjP6pqGHbQinc2IymQAcv 7sgdadbVzxqi+UA== X-Received: from dycrm6.prod.google.com ([2002:a05:693c:2a06:b0:328:58f9:d18]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:e74f:b0:2c6:90ec:f601 with SMTP id d9443c01a7336-2dae5e17d6emr11628295ad.8.1788295982264; Tue, 01 Sep 2026 13:53:02 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:46 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-7-cmllamas@google.com> Subject: [PATCH v4 6/7] binder: reject mremap() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support mremap() as it caches the mapping address in alloc->vm_start. Moving the mapping breaks the IPC communication for the process and can temporarily leak pages during a shrinker reclaim. Fix this by explicitly rejecting the .mremap() operation. Cc: stable@vger.kernel.org Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@goog= le.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 3d359490436e..290ccfde624d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -6040,11 +6040,17 @@ static int binder_vma_may_split(struct vm_area_stru= ct *vma, unsigned long addr) return -EINVAL; } =20 +static int binder_mremap(struct vm_area_struct *vma) +{ + return -EINVAL; +} + static const struct vm_operations_struct binder_vm_ops =3D { .open =3D binder_vma_open, .close =3D binder_vma_close, .fault =3D binder_vm_fault, .may_split =3D binder_vma_may_split, + .mremap =3D binder_mremap, }; =20 static int binder_mmap(struct file *filp, struct vm_area_struct *vma) --=20 2.55.0.966.g6673acef38-goog From nobody Sat Sep 26 11:47:01 2026 Received: from mail-pl1-f200.google.com (mail-pl1-f200.google.com [209.85.214.200]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACA7A4A4410 for ; Tue, 1 Sep 2026 20:53:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.200 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295986; cv=none; b=JmssjA7bMJV4djfZTjQrtYkxValVknLwSrbkeZrqHmh6ZCA4bTOP/rnM2MKhy6A3HlKzQURx5JP1sN6idsTvvcUImAUiQkQFlG+h75ZHQJqcpSFAsoSXfcwOuY1JBOYjH0QZV4f4XKfs9MYrSFjmeyfrwhYu+w5FxW0YD2ddneU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788295986; c=relaxed/simple; bh=QlZ8bwAY9neKKHezVtvtUAl90mGSvbr/T2WPNJJtduo=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=r9y5IzPurDJQkOYrxNCAvYzBFyZQ4tSx5Z4Lbi4TJiPxXsccCLxV+O/3s8x7StMp5+h6g0AIIyh8NY/D1p6uzZBL4RV+QOUCz377ovtIJXhCkeqBVGhQDRvpJRcg2CSJMv8FaBoXznqaJ55/SUgkJgeWnzURVlUjb95uJ34MGus= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=FYqTJLOz; arc=none smtp.client-ip=209.85.214.200 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--cmllamas.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="FYqTJLOz" Received: by mail-pl1-f200.google.com with SMTP id d9443c01a7336-2ccb687f82eso2979345ad.3 for ; Tue, 01 Sep 2026 13:53:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1788295984; x=1788900784; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=EyvdbyrwWKUxEUT3K6aHYWOVvt2Ms0Td9F6k6Xd72tY=; b=FYqTJLOzU27ADUxg6lvT0ymOoh99oi1suhtDCJo42vITNZ1LofNuIaDIJvzDikSYkl THb/2EJhodntsntoB9hduUrNffL/1jKcSaBcD1xSlSm5V9sIDf2WkxjIejMd9Ckjg7kE eV+bmOUpeSw6riC9MQFzSjmsDZ5tu1R7cJOWg5+NitxuTdJDT+pu3Eq2rYSfFo+2etLG +8uk7mn+lAAQn5R6QcjUIE4xrq5o6FJqqgJSzOftOFIqhYmOZBUUwlPLSg/FcYsldrIs 1CIumiU/i4G/mVpW/mbIh+BzvDeIkXfmVeDrfmfp5x3wYrKj5iFJZQZTFPB56/0Hz5OZ fy9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788295984; x=1788900784; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EyvdbyrwWKUxEUT3K6aHYWOVvt2Ms0Td9F6k6Xd72tY=; b=aWYEFC2PsNGVKesUFt4+6x9dvxG/IMnJnVk0nr+epj+Hvd+lMDE9RRAn6qfolgzlT8 lOC8BrGaaUIPjuHP3IKq5vUz0y6afBfjD4NX1+MPJiRQRPToFgEFjTRCK9akqYDKqJHH 1kw+qnz3ITM50l5XsQ7s+DWNRLBp95pLXuPPBUTGg+Ysr6jXhgWw8d6qVbruytc/T3cI YpMIY9h5f1/NRdT19obbqCyYdmBv3uVkoxtPJApmaOnrdHfJ1AzZAP4uheewaF2iEBM/ 7oVNwMbQQWK3EVlgV5TMBjd5TXJM+gXdw3r53ZtiFcnKQDoxUAevFpr2WA6T/IagOlEA T9jA== X-Forwarded-Encrypted: i=1; AKwUvBwe6kpCz2lJTFaDVzGx1HVdylztycmY+P9Yjl2lA2EtJUuI0l55bCV0b2iZctBa+TWR6JP8qBrodJlfMj4=@vger.kernel.org X-Gm-Message-State: AFuF++mC+rZAoE7ikB+Vid2Tan+Q+fxqx/+Upd9Ihf5GBrU5QYok5fAJ fXtY0wSyZw4jTyv+HfLsMvAI/jlXe7q3nLAXegElabiy2hJ7nkBpu84GS4Uc8bd3PHQfII4QVCK MeE1B8VuBfAAPpQ== X-Received: from dybnj33.prod.google.com ([2002:a05:7300:d0a1:b0:32e:56c:c1dd]) (user=cmllamas job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:5745:b0:38e:fea2:df53 with SMTP id 98e67ed59e1d1-39ae8219104mr1343490a91.4.1788295983615; Tue, 01 Sep 2026 13:53:03 -0700 (PDT) Date: Tue, 1 Sep 2026 20:52:47 +0000 In-Reply-To: <20260901205250.1638304-1-cmllamas@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260901205250.1638304-1-cmllamas@google.com> X-Mailer: git-send-email 2.55.0.966.g6673acef38-goog Message-ID: <20260901205250.1638304-8-cmllamas@google.com> Subject: [PATCH v4 7/7] rust_binder: reject mremap() From: Carlos Llamas To: Greg Kroah-Hartman , "=?UTF-8?q?Arve=20Hj=C3=B8nnev=C3=A5g?=" , Todd Kjos , Christian Brauner , Carlos Llamas , Alice Ryhl , Benno Lossin , Gary Guo Cc: kernel-team@android.com, linux-kernel@vger.kernel.org, Suren Baghdasaryan , stable@vger.kernel.org, Sashiko , "open list:RUST [PIN-INIT]:Keyword:bpin-initb|pin_initb|PinInit" Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Binder does not support mremap() as it caches the mapping address in Inner::vma_addr. Moving the mapping breaks the IPC communication for the process and can temporarily leak pages during a shrinker reclaim. Fix this by explicitly rejecting the .mremap() operation. Cc: stable@vger.kernel.org Fixes: eafedbc7c050 ("rust_binder: add Rust Binder driver") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260813193433.3318288-1-surenb@goog= le.com?part=3D2 Signed-off-by: Carlos Llamas --- drivers/android/binder/page_range.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/android/binder/page_range.rs b/drivers/android/binder/= page_range.rs index d260b009c184..c6247ba03313 100644 --- a/drivers/android/binder/page_range.rs +++ b/drivers/android/binder/page_range.rs @@ -148,9 +148,14 @@ pub(crate) struct ShrinkablePageRange { EINVAL.to_errno() } =20 +unsafe extern "C" fn binder_mremap(_: *mut bindings::vm_area_struct) -> c_= int { + EINVAL.to_errno() +} + static BINDER_VM_OPS: AssertSync =3D { let ops =3D bindings::vm_operations_struct { may_split: Some(binder_vma_may_split), + mremap: Some(binder_mremap), ..pin_init::zeroed() }; AssertSync(ops) --=20 2.55.0.966.g6673acef38-goog