linux-kernel - [PATCH v3 0/7] binder: eliminate use of vmalloc space for binder buffers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri,  8 Feb 2019 10:35:13 -0800
From:   Todd Kjos <tkjos@...roid.com>
To:     tkjos@...gle.com, gregkh@...uxfoundation.org, arve@...roid.com,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        maco@...gle.com
Cc:     joel@...lfernandes.org, kernel-team@...roid.com
Subject: [PATCH v3 0/7] binder: eliminate use of vmalloc space for binder buffers

Binder buffers have always been mapped into kernel space
via map_kernel_range_noflush() to allow the binder driver
to modify the buffer before posting to userspace for
processing.

In recent Android releases, the number of long-running
binder processes has increased to the point that for
32-bit systems, there is a risk of running out of
vmalloc space.

This patch set removes the persistent mapping of the
binder buffers into kernel space. Instead, the binder
driver creates temporary mappings with kmap() or
kmap_atomic() to copy to or from the buffer only when
necessary.

Todd Kjos (7):
	binder: create userspace-to-binder-buffer copy function
	binder: add functions to copy to/from binder buffers
	binder: add function to copy binder object from buffer
	binder: avoid kernel vm_area for buffer fixups
	binder: remove kernel vm_area for buffer space
	binder: remove user_buffer_offset
	binder: use userspace pointer as base of buffer space

v2: remove casts as suggested by Dan Carpenter
v3: fix build-break when CONFIG_ANDROID_BINDER_IPC_SELFTEST enabled

 drivers/android/Kconfig                 |   2 +-
 drivers/android/binder.c                | 460 ++++++++++++++++++++++++++++++++++++++++++++++++++----------------------------
 drivers/android/binder_alloc.c          | 299 +++++++++++++++++++++++++++++++++++++--------------
 drivers/android/binder_alloc.h          |  47 ++++----
 drivers/android/binder_alloc_selftest.c |   4 +-
 drivers/android/binder_trace.h          |   2 +-
 6 files changed, 536 insertions(+), 278 deletions(-)