From: Todd Kjos <tkjos@google.com>
To: Christian Brauner <christian.brauner@ubuntu.com>
Cc: "Joel Fernandes" <joel@joelfernandes.org>,
"Todd Kjos" <tkjos@android.com>, "Jann Horn" <jannh@google.com>,
"Arve Hjønnevåg" <arve@android.com>,
"Christian Brauner" <christian@brauner.io>,
"open list:ANDROID DRIVERS" <devel@driverdev.osuosl.org>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
LKML <linux-kernel@vger.kernel.org>,
"Martijn Coenen" <maco@android.com>,
"Hridya Valsaraju" <hridya@google.com>
Subject: Re: [PATCH] binder: prevent UAF read in print_binder_transaction_log_entry()
Date: Wed, 9 Oct 2019 08:56:28 -0700 [thread overview]
Message-ID: <CAHRSSExAL3fQMP9x9p34qF8dnFKLSp7EzhZ7Y5y-qbzExCRo1w@mail.gmail.com> (raw)
In-Reply-To: <20191009104011.rzfdvq7otkkj533m@wittgenstein>
On Wed, Oct 9, 2019 at 3:40 AM Christian Brauner
<christian.brauner@ubuntu.com> wrote:
>
> On Tue, Oct 08, 2019 at 02:05:16PM -0400, Joel Fernandes wrote:
> > On Tue, Oct 08, 2019 at 03:01:59PM +0200, Christian Brauner wrote:
[...]
> >
> > One more thought, this can be made dependent on CONFIG_BINDERFS since regular
> > binder devices cannot be unregistered AFAICS and as Jann said, the problem is
> > BINDERFS specific. That way we avoid the memcpy for _every_ transaction.
> > These can be thundering when Android starts up.
>
> Unless Todd sees this as a real performance problem I'm weary to
> introduce additional checking and record a pointer for non-binderfs and
> a memcpy() for binderfs devices. :)
>
I don't see this as a real problem. In practice, memcpy will be moving
< 10 bytes. Also, by the time this code is in an android device,
CONFIG_BINDERFS will always be enabled since this is how we are
removing binder's use of debugfs. So a micro-optimization of the
!BINDERFS case will not be meaningful.
[...]
next prev parent reply other threads:[~2019-10-09 15:56 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-07 20:49 UAF read in print_binder_transaction_log_entry() on ANDROID_BINDERFS kernels Jann Horn
2019-10-07 21:04 ` Todd Kjos
2019-10-07 21:16 ` Hridya Valsaraju
2019-10-07 21:05 ` Christian Brauner
2019-10-08 13:01 ` [PATCH] binder: prevent UAF read in print_binder_transaction_log_entry() Christian Brauner
2019-10-08 17:18 ` Hridya Valsaraju
2019-10-08 18:05 ` Joel Fernandes
2019-10-09 10:40 ` Christian Brauner
2019-10-09 14:21 ` Joel Fernandes
2019-10-09 14:29 ` Christian Brauner
2019-10-09 14:55 ` Joel Fernandes
2019-10-09 15:10 ` Christian Brauner
2019-10-09 15:37 ` Joel Fernandes
2019-10-09 15:56 ` Todd Kjos [this message]
2019-10-08 18:52 ` Todd Kjos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHRSSExAL3fQMP9x9p34qF8dnFKLSp7EzhZ7Y5y-qbzExCRo1w@mail.gmail.com \
--to=tkjos@google.com \
--cc=arve@android.com \
--cc=christian.brauner@ubuntu.com \
--cc=christian@brauner.io \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=hridya@google.com \
--cc=jannh@google.com \
--cc=joel@joelfernandes.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maco@android.com \
--cc=tkjos@android.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).