From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1754803AbcA1HKl (ORCPT <rfc822;w@1wt.eu>);
	Thu, 28 Jan 2016 02:10:41 -0500
Received: from szxga01-in.huawei.com ([58.251.152.64]:30993 "EHLO
	szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1754324AbcA1HKg (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Thu, 28 Jan 2016 02:10:36 -0500
Subject: Re: [PATCH v2] android: binder: Sanity check at binder ioctl
To: David Rientjes <rientjes@google.com>
References: <1453194241-55201-1-git-send-email-puck.chen@hisilicon.com>
 <alpine.DEB.2.10.1601191436370.7346@chino.kir.corp.google.com>
CC: <gregkh@linuxfoundation.org>, <arve@android.com>, <riandrews@android.com>,
        <devel@driverdev.osuosl.org>, <linux-kernel@vger.kernel.org>,
        <yudongbin@hisilicon.com>, <saberlily.xia@hisilicon.com>,
        <suzhuangluan@hisilicon.com>, <kong.kongxinwei@hisilicon.com>,
        <xuyiping@hisilicon.com>, <z.liuxinliang@hisilicon.com>,
        <weidong2@hisilicon.com>, <w.f@huawei.com>, <puck.chen@foxmail.com>,
        <shimingxing@hisilicon.com>, <oliver.fu@hisilicon.com>,
        <albert.lubing@hisilicon.com>, <chenxiang9@huawei.com>,
        <liuzixing@huawei.com>, <haojian.zhuang@linaro.org>,
        <zhaojunmin@huawei.com>, <wangjing6@huawei.com>,
        <john.stultz@linaro.org>, <qijiwen@hisilicon.com>,
        <peter.panshilin@hisilicon.com>, <dan.zhao@hisilicon.com>,
        <linuxarm@huawei.com>, <dev@lists.96boards.org>
From: chenfeng <puck.chen@hisilicon.com>
Message-ID: <56A9BE66.80400@hisilicon.com>
Date: Thu, 28 Jan 2016 15:08:22 +0800
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101
 Thunderbird/38.2.0
MIME-Version: 1.0
In-Reply-To: <alpine.DEB.2.10.1601191436370.7346@chino.kir.corp.google.com>
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: 7bit
X-Originating-IP: [10.142.192.172]
X-CFilter-Loop: Reflected
X-Mirapoint-Virus-RAPID-Raw: score=unknown(0),
	refid=str=0001.0A090205.56A9BEE7.00B2,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0,
	ip=0.0.0.0,
	so=2013-06-18 04:22:30,
	dmn=2013-03-21 17:37:32
X-Mirapoint-Loop-Id: ab19139f9cb030d4279ad89a128ffe7c
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi,

On 2016/1/20 6:40, David Rientjes wrote:
> On Tue, 19 Jan 2016, Chen Feng wrote:
> 
>> When a process fork a child process, we should not allow the
>> child process use the binder which opened by parent process.
>>
>> But if the binder-object creater is a thread of one process who exit,
>> the other thread can also use this binder-object normally.
>> We can distinguish this by the member proc->tsk->mm.
>> If the thread exit the tsk->mm will be NULL.
>>
> 
> Why does exit_mm(), the point where tsk->mm == NULL, signify the point at 
> which the binder can now be used by other threads?

Yes,the other threads used this shared mm for communication. A lots of APPs
have this issue.

For example: system_server process use many libs,libstagefright, Libdrmframeworketc,
In these lib, binder global object exist like static sp<DeathNotifier> sDeathNotifier,
static sp<IDrmManagerService> sDrmManagerService;
When system_sever process fork failed, the new child process call exit, which will call
hook destruction function.
In destruction, the parent process *binder reference count will be wrong*. To protect
these exception, we need to add the code in binder.

For v2 patch, I agree with your opinion, some race condition exist in some special case.
I found that the task->mm already cached at binder_mm.
proc->vma_vm_mm = vma->vm_mm;
I will change the condition to  if (unlikely(current->mm != proc->tsk->mm)).
But in some scenes, the thread do communication before the mmap called.
So I add proc->vma_vm_mm = current->mm where the binder_open function.

Since the binder init process in libbinder, the fix won't produce side effect.
If these are accepted, I will send a new V3 version.


> 
>> proc->tsk->mm != current->mm && proc->tsk->mm
>>
>> So only allow the shared mm_struct to use the same binder-object and
>> check the existence of mm_struct.
>>
>> V2: Fix compile error for error commit
>>
>> Signed-off-by: Chen Feng <puck.chen@hisilicon.com>
>> Signed-off-by: Wei  Dong <weidong2@hisilicon.com>
>> Signed-off-by: Junmin Zhao <zhaojunmin@huawei.com>
>> Reviewed-by: Zhuangluan Su <suzhuangluan@hisilicon.com>
>> ---
>>  drivers/android/binder.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/drivers/android/binder.c b/drivers/android/binder.c
>> index a39e85f..279063c 100644
>> --- a/drivers/android/binder.c
>> +++ b/drivers/android/binder.c
>> @@ -2736,6 +2736,8 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
>>  
>>  	/*pr_info("binder_ioctl: %d:%d %x %lx\n",
>>  			proc->pid, current->pid, cmd, arg);*/
>> +	if (unlikely(proc->tsk->mm != current->mm && proc->tsk->mm))
>> +		return -EINVAL;
>>  
>>  	trace_binder_ioctl(cmd, arg);
>>  
> 
> I would imagine that you would want to do READ_ONCE(proc->tsk->mm) so you 
> are guaranteed to be testing the same value.
> 
> .
>