Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751432AbdH3Jao (ORCPT ); Wed, 30 Aug 2017 05:30:44 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:34766 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750835AbdH3Jan (ORCPT ); Wed, 30 Aug 2017 05:30:43 -0400 Date: Wed, 30 Aug 2017 12:29:05 +0300 From: Dan Carpenter To: Sherry Yang , Arve =?iso-8859-1?B?SGr4bm5lduVn?= Cc: linux-kernel@vger.kernel.org, "open list:ANDROID DRIVERS" , Greg Kroah-Hartman , Riley Andrews , maco@google.com, tkjos@google.com Subject: Re: [PATCH v3 3/6] android: binder: Move buffer out of area shared with user space Message-ID: <20170830092904.b43bmlveo5g4c6rd@mwanda> References: <20170830004702.120371-1-sherryy@android.com> <20170830004702.120371-4-sherryy@android.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170830004702.120371-4-sherryy@android.com> User-Agent: NeoMutt/20170113 (1.7.2) X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1608 Lines: 37 On Tue, Aug 29, 2017 at 05:46:59PM -0700, Sherry Yang wrote: > Binder driver allocates buffer meta data in a region that is mapped > in user space. These meta data contain pointers in the kernel. > > This patch allocates buffer meta data on the kernel heap that is > not mapped in user space, and uses a pointer to refer to the data mapped. > > Also move alloc->buffers initialization from mmap to init since it's > now used even when mmap failed or was not called. > > Signed-off-by: Sherry Yang > --- The difference between v2 and v3 is that we've shifted some initialization around to fix the crashing bug that kbuild found. You should not that difference here under the --- cut off. > drivers/android/binder_alloc.c | 146 +++++++++++++++++++------------- > drivers/android/binder_alloc.h | 2 +- > drivers/android/binder_alloc_selftest.c | 11 ++- > 3 files changed, 91 insertions(+), 68 deletions(-) But really we still need to have some answers or discussion about the questions that Greg and I raised. Greg asked if the other Android devs had Acked this. Please ping Arve to Ack this. I was curious about the security impact or why we were writing this patch 3/6. It seems we are fixing an information disclosure bug. Or is it something worse than that? Or have I misunderstood entirely. We probably original put the buffers in userspace for accounting reasons so we could kill programs that used too much RAM. This patch doesn't create a problem with that hopefully? We're just moving the metadata to kernel space? regards, dan carpenter