linux-kernel - Re: [PATCH v11 2/2] binder: report txn errors via generic netlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z32fhN6yq673YwmO@google.com>
Date: Tue, 7 Jan 2025 21:41:24 +0000
From: Carlos Llamas <cmllamas@...gle.com>
To: Li Li <dualli@...omium.org>
Cc: dualli@...gle.com, corbet@....net, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	donald.hunter@...il.com, gregkh@...uxfoundation.org,
	arve@...roid.com, tkjos@...roid.com, maco@...roid.com,
	joel@...lfernandes.org, brauner@...nel.org, surenb@...gle.com,
	arnd@...db.de, masahiroy@...nel.org, bagasdotme@...il.com,
	horms@...nel.org, linux-kernel@...r.kernel.org,
	linux-doc@...r.kernel.org, netdev@...r.kernel.org,
	hridya@...gle.com, smoreland@...gle.com, kernel-team@...roid.com
Subject: Re: [PATCH v11 2/2] binder: report txn errors via generic netlink

On Tue, Jan 07, 2025 at 09:29:08PM +0000, Carlos Llamas wrote:
> On Wed, Dec 18, 2024 at 12:37:40PM -0800, Li Li wrote:
> > From: Li Li <dualli@...gle.com>
> 
> > @@ -6137,6 +6264,11 @@ static int binder_release(struct inode *nodp, struct file *filp)
> >  
> >  	binder_defer_work(proc, BINDER_DEFERRED_RELEASE);
> >  
> > +	if (proc->pid == proc->context->report_portid) {
> > +		proc->context->report_portid = 0;
> > +		proc->context->report_flags = 0;
> 
> Isn't ->portid the pid from the netlink report manager? How is this ever
> going to match a certain proc->pid here? Is this manager supposed to
> _also_ open a regular binder fd?
> 
> It seems we are tying the cleanup of the netlink interface to the exit
> of the regular binder device, correct? This seems unfortunate as using
> the netlink interface should be independent.
> 
> I was playing around with this patch with my own PoC and now I'm stuck:
>   root@...ian:~# ./binder-netlink
>   ./binder-netlink: nlmsgerr No permission to set flags from 1301: Unknown error -1
> 
> Is there a different way to reset the protid?
> 

Furthermore, this seems to be a problem when the report manager exits
without a binder instance, we still think the report is enabled:

[  202.821346] binder: Failed to send binder netlink message to 597: -111
[  202.821421] binder: Failed to send binder netlink message to 597: -111
[  202.821304] binder: Failed to send binder netlink message to 597: -111
[  202.821306] binder: Failed to send binder netlink message to 597: -111
[  202.821387] binder: Failed to send binder netlink message to 597: -111
[  202.821464] binder: Failed to send binder netlink message to 597: -111
[  202.821467] binder: Failed to send binder netlink message to 597: -111
[  202.821344] binder: Failed to send binder netlink message to 597: -111
[  202.822513] binder: Failed to send binder netlink message to 597: -111
[  202.822152] binder: Failed to send binder netlink message to 597: -111
[  202.822683] binder: Failed to send binder netlink message to 597: -111
[  202.822629] binder: Failed to send binder netlink message to 597: -111