linux-kernel - [PATCHv2 1/3] staging: binder: Fix ABI for 64bit Android

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 21 Feb 2014 14:40:25 -0800
From:	John Stultz <john.stultz@...aro.org>
To:	LKML <linux-kernel@...r.kernel.org>
Cc:	Serban Constantinescu <serban.constantinescu@....com>,
	Greg KH <gregkh@...uxfoundation.org>,
	Colin Cross <ccross@...roid.com>,
	Arve Hjønnevåg <arve@...roid.com>,
	Android Kernel Team <kernel-team@...roid.com>,
	John Stultz <john.stultz@...aro.org>
Subject: [PATCHv2 1/3] staging: binder: Fix ABI for 64bit Android

From: Serban Constantinescu <serban.constantinescu@....com>

BC_REQUEST_DEATH_NOTIFICATION and BC_CLEAR_DEATH_NOTIFICATION were
defined with the wrong structure that did not match the code. Since a
binder pointer and handle are the same size on 32 bit systems, this
change does not affect them. The two commands claimed they were using
struct binder_ptr_cookie but they are using a 32bit handle and a pointer.

The main purpose of this patch is to add the binder_handle_cookie
struct so the service manager does not have to define its own version
(libbinder writes one field at a time so it does not use the struct).

On 32bit systems the payload size is the same as the size of struct
binder_ptr_cookie. On 64bit systems, the size does differ, and the
ioctl number does change. However, there are no known 64bit users of
this interface, and any 64bit systems will need the following patch to
run 32 bit processes anyway, so it is not expected that anyone will
ship a 64bit system without this change, so this change should not
affect any existing systems.

Cc: Greg KH <gregkh@...uxfoundation.org>
Cc: Colin Cross <ccross@...roid.com>
Cc: Arve Hjønnevåg <arve@...roid.com>
Cc: Serban Constantinescu <serban.constantinescu@....com>
Cc: Android Kernel Team <kernel-team@...roid.com>
Signed-off-by: Serban Constantinescu <serban.constantinescu@....com>
[jstultz: Few 80+ col fixes for checkpatch, improved commit message
with help from Serban, and included rational from Arve's email]
Signed-off-by: John Stultz <john.stultz@...aro.org>
---
 drivers/staging/android/uapi/binder.h | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/android/uapi/binder.h b/drivers/staging/android/uapi/binder.h
index 2b1eb81..4071fcf 100644
--- a/drivers/staging/android/uapi/binder.h
+++ b/drivers/staging/android/uapi/binder.h
@@ -152,6 +152,11 @@ struct binder_ptr_cookie {
 	void *cookie;
 };
 
+struct binder_handle_cookie {
+	__u32 handle;
+	void *cookie;
+} __attribute__((packed));
+
 struct binder_pri_desc {
 	__s32 priority;
 	__u32 desc;
@@ -308,15 +313,17 @@ enum binder_driver_command_protocol {
 	 * of looping threads it has available.
 	 */
 
-	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14, struct binder_ptr_cookie),
+	BC_REQUEST_DEATH_NOTIFICATION = _IOW('c', 14,
+						struct binder_handle_cookie),
 	/*
-	 * void *: ptr to binder
+	 * int: handle
 	 * void *: cookie
 	 */
 
-	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15, struct binder_ptr_cookie),
+	BC_CLEAR_DEATH_NOTIFICATION = _IOW('c', 15,
+						struct binder_handle_cookie),
 	/*
-	 * void *: ptr to binder
+	 * int: handle
 	 * void *: cookie
 	 */
 
-- 
1.8.3.2

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/