`binder_vm_ops` does not implement `.may_split` or `.mremap`, and
`binder_vma_close()` unconditionally calls
`binder_alloc_vma_close(&proc->alloc)` (which sets `alloc->vma = NULL`).

If userspace calls `munmap()` on a sub-range of the binder mapping (or
`mremap()` to move/split a sub-range), the VMA is split into two VMAs
sharing the same `binder_proc`, and `binder_vma_close()` runs on the
unmapped half and clears `alloc->vma = NULL` while the remaining VMA
stays mapped in the process's address space, desynchronizing
`alloc->vma` from the remaining VMA.

Implement `.may_split` and `.mremap` returning `-EINVAL` in
`binder_vm_ops` and check `vma->vm_start == proc->alloc.vm_start` in
`binder_vma_close()`.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 drivers/android/binder.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 8f2ef1bd539f..1c7218e599a1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -6023,9 +6058,21 @@ static void binder_vma_close(struct vm_area_struct *vma)
 		     proc->pid, vma->vm_start, vma->vm_end,
 		     (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
 		     (unsigned long)pgprot_val(vma->vm_page_prot));
+	if (vma->vm_start != proc->alloc.vm_start)
+		return;
 	binder_alloc_vma_close(&proc->alloc);
 }
 
+static int binder_may_split(struct vm_area_struct *vma, unsigned long addr)
+{
+	return -EINVAL;
+}
+
+static int binder_mremap(struct vm_area_struct *vma)
+{
+	return -EINVAL;
+}
+
 VISIBLE_IF_KUNIT vm_fault_t binder_vm_fault(struct vm_fault *vmf)
 {
 	return VM_FAULT_SIGBUS;
@@ -6035,6 +6082,8 @@ EXPORT_SYMBOL_IF_KUNIT(binder_vm_fault);
 static const struct vm_operations_struct binder_vm_ops = {
 	.open = binder_vma_open,
 	.close = binder_vma_close,
+	.may_split = binder_may_split,
+	.mremap = binder_mremap,
 	.fault = binder_vm_fault,
 };

On Sat, Sep 19, 2026 at 09:36:53PM +0000, Hui Peng wrote:
> `binder_vm_ops` does not implement `.may_split` or `.mremap`, and
> `binder_vma_close()` unconditionally calls
> `binder_alloc_vma_close(&proc->alloc)` (which sets `alloc->vma = NULL`).
> 
> If userspace calls `munmap()` on a sub-range of the binder mapping (or
> `mremap()` to move/split a sub-range), the VMA is split into two VMAs
> sharing the same `binder_proc`, and `binder_vma_close()` runs on the
> unmapped half and clears `alloc->vma = NULL` while the remaining VMA
> stays mapped in the process's address space, desynchronizing
> `alloc->vma` from the remaining VMA.
> 
> Implement `.may_split` and `.mremap` returning `-EINVAL` in
> `binder_vm_ops` and check `vma->vm_start == proc->alloc.vm_start` in
> `binder_vma_close()`.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

This is not correct.

Also, this exact fix has been previously sent here:
https://lore.kernel.org/all/20260901205250.1638304-1-cmllamas@google.com/

--
Carlos Llamas