linux-kernel - Re: [PATCH v2 1/2] binder: Address corner cases in deferred copy and fixup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAHRSSEwZZMRkytqAMQOL7Ms6dCNZ7VaEf+ykLz82uAVW58Lxdw@mail.gmail.com>
Date:   Tue, 19 Apr 2022 11:48:23 -0700
From:   Todd Kjos <tkjos@...gle.com>
To:     Alessandro Astone <ales.astone@...il.com>
Cc:     tkjos@...roid.com, gregkh@...uxfoundation.org, brauner@...nel.org,
        arve@...roid.com, linux-kernel@...r.kernel.org, maco@...roid.com,
        Joel Fernandes <joel@...lfernandes.org>,
        Hridya Valsaraju <hridya@...gle.com>,
        Suren Baghdasaryan <surenb@...gle.com>
Subject: Re: [PATCH v2 1/2] binder: Address corner cases in deferred copy and fixup

On Fri, Apr 15, 2022 at 5:00 AM Alessandro Astone <ales.astone@...il.com> wrote:
>
> When handling BINDER_TYPE_FDA object we are pushing a parent fixup
> with a certain skip_size but no scatter-gather copy object, since
> the copy is handled standalone.
> If BINDER_TYPE_FDA is the last children the scatter-gather copy
> loop will never stop to skip it, thus we are left with an item in
> the parent fixup list. This will trigger the BUG_ON().
>
> This is reproducible in android when playing a video.
> We receive a transaction that looks like this:
>     obj[0] BINDER_TYPE_PTR, parent
>     obj[1] BINDER_TYPE_PTR, child
>     obj[2] BINDER_TYPE_PTR, child
>     obj[3] BINDER_TYPE_FDA, child
>
> Fixes: 09184ae9b575 ("binder: defer copies of pre-patched txn data")
> Signed-off-by: Alessandro Astone <ales.astone@...il.com>

Acked-by: Todd Kjos <tkjos@...gle.com>


> ---
>  drivers/android/binder.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
> index 8351c5638880..31176edb1069 100644
> --- a/drivers/android/binder.c
> +++ b/drivers/android/binder.c
> @@ -2295,6 +2295,7 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
>  {
>         int ret = 0;
>         struct binder_sg_copy *sgc, *tmpsgc;
> +       struct binder_ptr_fixup *tmppf;
>         struct binder_ptr_fixup *pf =
>                 list_first_entry_or_null(pf_head, struct binder_ptr_fixup,
>                                          node);
> @@ -2349,7 +2350,11 @@ static int binder_do_deferred_txn_copies(struct binder_alloc *alloc,
>                 list_del(&sgc->node);
>                 kfree(sgc);
>         }
> -       BUG_ON(!list_empty(pf_head));
> +       list_for_each_entry_safe(pf, tmppf, pf_head, node) {
> +               BUG_ON(pf->skip_size == 0);
> +               list_del(&pf->node);
> +               kfree(pf);
> +       }
>         BUG_ON(!list_empty(sgc_head));
>
>         return ret > 0 ? -EINVAL : ret;
> --
> 2.35.1
>