linux-kernel - Re: [PATCH] binder: don't detect sender/target during buffer cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHRSSEwz-J57rz3n7-fnzK6gyY66WmvuG6BT6XdG6jZB668CWw@mail.gmail.com>
Date:   Tue, 2 Nov 2021 08:12:35 -0700
From:   Todd Kjos <tkjos@...gle.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     gregkh@...uxfoundation.org, christian@...uner.io, arve@...roid.com,
        jannh@...gle.com, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, maco@...gle.com,
        joel@...lfernandes.org, kernel-team@...roid.com
Subject: Re: [PATCH] binder: don't detect sender/target during buffer cleanup

On Tue, Nov 2, 2021 at 6:24 AM Dan Carpenter <dan.carpenter@...cle.com> wrote:
>
> On Fri, Oct 15, 2021 at 04:38:11PM -0700, Todd Kjos wrote:
> > When freeing txn buffers, binder_transaction_buffer_release()
> > attempts to detect whether the current context is the target by
> > comparing current->group_leader to proc->tsk. This is an unreliable
> > test. Instead explicitly pass an 'is_failure' boolean.
> >
> > Detecting the sender was being used as a way to tell if the
> > transaction failed to be sent.  When cleaning up after
> > failing to send a transaction, there is no need to close
> > the fds associated with a BINDER_TYPE_FDA object. Now
> > 'is_failure' can be used to accurately detect this case.
> >
>
> It's really hard for me to understand what this bug looks like to the
> user?  Is it a memory leak or do we free the wrong thing?

It is a difficult case to hit (impossible for "well-behaved"
processes), but it could result in file descriptors being closed when
they shouldn't be.

>
> regards,
> dan carpenter
>
> --
> To unsubscribe from this group and stop receiving emails from it, send an email to kernel-team+unsubscribe@...roid.com.
>