linux-kernel - Binder regression caused by commit a43cfc87caaf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 8 Aug 2022 12:13:17 +0200
From:   Ondrej Mosnacek <omosnace@...hat.com>
To:     "Liam R. Howlett" <Liam.Howlett@...cle.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     Minchan Kim <minchan@...nel.org>,
        "Christian Brauner (Microsoft)" <brauner@...nel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Hridya Valsaraju <hridya@...gle.com>,
        Joel Fernandes <joel@...lfernandes.org>,
        Martijn Coenen <maco@...roid.com>,
        Suren Baghdasaryan <surenb@...gle.com>,
        Todd Kjos <tkjos@...roid.com>,
        "Matthew Wilcox (Oracle)" <willy@...radead.org>,
        Linux kernel mailing list <linux-kernel@...r.kernel.org>,
        Arve Hjønnevåg <arve@...roid.com>,
        Carlos Llamas <cmllamas@...gle.com>
Subject: Binder regression caused by commit a43cfc87caaf

Hello,

FYI, since commit a43cfc87caaf ("android: binder: stop saving a
pointer to the VMA") (found by git bisect) the binder test in
selinux-testsuite [1] started to trigger a lockdep assert BUG() in
find_vma() - see the end of [2] for an example.

A minimal reproducer is:
```
git clone https://github.com/SELinuxProject/selinux-testsuite.git
cd selinux-testsuite/tests/binder
make
setenforce 0  # if SELinux is enabled
./init_binder.sh || true
./manager -n -v & sleep 2
./service_provider -n -v
```
Requires the equivalent of libselinux-devel, make, gcc, and git-core
Fedora packages.
The last command will trigger the BUG; on good kernels it will
successfully enter the ioctl loop.

[1] https://github.com/SELinuxProject/selinux-testsuite/
[2] https://s3.us-east-1.amazonaws.com/arr-cki-prod-datawarehouse-public/datawarehouse-public/2022/08/07/redhat:606549366/build_x86_64_redhat:606549366_x86_64/tests/5/results_0001/console.log/console.log

-- 
Ondrej Mosnacek
Senior Software Engineer, Linux Security - SELinux kernel
Red Hat, Inc.