linux-kernel - Re: [PATCH v11 2/2] binder: report txn errors via generic netlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z32cpF4tkP5hUbgv@google.com>
Date: Tue, 7 Jan 2025 21:29:08 +0000
From: Carlos Llamas <cmllamas@...gle.com>
To: Li Li <dualli@...omium.org>
Cc: dualli@...gle.com, corbet@....net, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	donald.hunter@...il.com, gregkh@...uxfoundation.org,
	arve@...roid.com, tkjos@...roid.com, maco@...roid.com,
	joel@...lfernandes.org, brauner@...nel.org, surenb@...gle.com,
	arnd@...db.de, masahiroy@...nel.org, bagasdotme@...il.com,
	horms@...nel.org, linux-kernel@...r.kernel.org,
	linux-doc@...r.kernel.org, netdev@...r.kernel.org,
	hridya@...gle.com, smoreland@...gle.com, kernel-team@...roid.com
Subject: Re: [PATCH v11 2/2] binder: report txn errors via generic netlink

On Wed, Dec 18, 2024 at 12:37:40PM -0800, Li Li wrote:
> From: Li Li <dualli@...gle.com>

> @@ -6137,6 +6264,11 @@ static int binder_release(struct inode *nodp, struct file *filp)
>  
>  	binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
>  
> +	if (proc->pid == proc->context->report_portid) {
> +		proc->context->report_portid = 0;
> +		proc->context->report_flags = 0;

Isn't ->portid the pid from the netlink report manager? How is this ever
going to match a certain proc->pid here? Is this manager supposed to
_also_ open a regular binder fd?

It seems we are tying the cleanup of the netlink interface to the exit
of the regular binder device, correct? This seems unfortunate as using
the netlink interface should be independent.

I was playing around with this patch with my own PoC and now I'm stuck:
  root@...ian:~# ./binder-netlink
  ./binder-netlink: nlmsgerr No permission to set flags from 1301: Unknown error -1

Is there a different way to reset the protid?

--
Carlos Llamas