linux-kernel - [PATCH v2 0/4] binder: Prevent untranslated sender data from being copied to target

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20211130185152.437403-1-tkjos@google.com>
Date:   Tue, 30 Nov 2021 10:51:48 -0800
From:   Todd Kjos <tkjos@...gle.com>
To:     tkjos@...gle.com, gregkh@...uxfoundation.org, christian@...uner.io,
        arve@...roid.com, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, maco@...gle.com
Cc:     joel@...lfernandes.org, kernel-team@...roid.com, avakj45@...il.com
Subject: [PATCH v2 0/4] binder: Prevent untranslated sender data from being
 copied to target

Binder copies transactions directly from the sender buffer
to the target buffer and then fixes up BINDER_TYPE_PTR and
BINDER_TYPE_FDA objects. This means there is a brief time
when sender pointers and fds are visible to the target
process.

This series reworks the the sender to target copy to
avoid leaking any untranslated sender data from being
visible in the target.

Todd Kjos (4):
  binder: binder: fix handling of error during copy
  binder: defer copies of pre-patched txn data
  binder: read pre-translated fds from sender buffer
  binder: avoid potential data leakage when copying txn

v2:
- add "binder: fix handling of error during copy" to fix
  bug noticed by Dan Carpenter
- address Dan Carpenter's comments

 drivers/android/binder.c | 442 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 387 insertions(+), 55 deletions(-)