Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 2 Nov 2021 16:23:36 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Todd Kjos <tkjos@google.com>
Cc:     gregkh@linuxfoundation.org, christian@brauner.io, arve@android.com,
        jannh@google.com, devel@driverdev.osuosl.org,
        linux-kernel@vger.kernel.org, maco@google.com,
        joel@joelfernandes.org, kernel-team@android.com
Subject: Re: [PATCH] binder: don't detect sender/target during buffer cleanup
Message-ID: <20211102132336.GG2794@kadam>
References: <20211015233811.3532235-1-tkjos@google.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20211015233811.3532235-1-tkjos@google.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?bFYdTqQ0D8y5FxheNjlHMahcpy1wA09MDZfC/LDCBQ4VuHMnDw+CgFFu4bdl?=
 =?us-ascii?Q?3wTE9t9OOFuIuubD90bFyIJB7sRkTwsRHKSw5pRrAPZkRwJHWvhQJpcTjiuG?=
 =?us-ascii?Q?56v0VHhjgPig//zzZvMw9CIASwAMMFOQ7mGwK/u6xC0vu0ZURjov0ipn4x2q?=
 =?us-ascii?Q?QZxbQRJrlN3Ad9c9ADkQcZN7z0P1FswWvvqKcpsDL9Ng94slssdpNkq2Khtp?=
 =?us-ascii?Q?jZmQ6gk9vQoU6/UJuqCE9GWWEsIXJ/SlNw2A7dLuaYhIqb2TxF66JF9Si3q9?=
 =?us-ascii?Q?KYaBlI3YlF5lYQaO8IgS3EnUEHrGGA+Kpe589olzASY/uZD3Xt1iYT+6Whq7?=
 =?us-ascii?Q?+2coQtofEHv9EqZRdwMcJ+rsNuRf8D+52gkPk8SZU+PiE0puxOnXpT6xtKDu?=
 =?us-ascii?Q?iCvyrBj/9R8q4u9HADFvSkw3HLy8bjHC7BpH7PoNZEfKJt+gxMNwumJCkJ4H?=
 =?us-ascii?Q?MCRE2mhOcX3x8LCPHKSlsbLJuCYrA0PDa/77pxX2DQWRxh2tfj6iceFR0BAf?=
 =?us-ascii?Q?e4HXRr4jPcBFy1kgJDjH0hNyoeiWiOP4SkeY5o5BZWN0VcR48fGZgT/iEBcr?=
 =?us-ascii?Q?ytrrhNNJVwTRwingiRqq1rOMP676P6kIxrwTi1a3b4rY3mFigguKLsPit5F2?=
 =?us-ascii?Q?z5XnJ0hI8p36zeywDjHUTnjsFeiOoUmSy+Vqx6sqHtyLHckewSIqWOnE/KbH?=
 =?us-ascii?Q?IGemG3XZ0FijbgajkNG3SrrO3b6HxpWuJbPaU1iPTErig8tZHO6YUP8Sqr8H?=
 =?us-ascii?Q?gq9oaKznbFElP6I3hkb0MKx3OqtbjrMydYu9j3wNG/u/zMKg4gPi24MYlOTD?=
 =?us-ascii?Q?E/hSxs3qYZIdbxickmQsFwurQtjH0G4WBvFjo9cJpjds+np5ZIjkiysy6Iwo?=
 =?us-ascii?Q?5G5wFXz7XtleYZo9SATWWWjT/I9IudESBR+D0EL0hrmBoNj+kh/DFJ1tQuo9?=
 =?us-ascii?Q?jcJ6GQoCZwigr95EXz8QrfMuOHpQWIX7ZkuGW0Ngnv7xHKV2P8OZMGvWR4YO?=
 =?us-ascii?Q?ixlDiQM0Fb6mhukAY/ryUVeu9UwYvfX2TUpu4cr1kJ5fExlePLomvoy3QfBK?=
 =?us-ascii?Q?6jG5aPMqS2bM7l0YaSsKZ5tgCwgzUrxuJmMNw6Uorvv+BaFbqS3hitCOGY1p?=
 =?us-ascii?Q?MmWTQh/CNsyP3u0rfpwysHnN/+4PCWmzx5K86XrLNlXtrJNaYpk1Y/3fi0Wx?=
 =?us-ascii?Q?1pCGCQrspSvYnrhES+2bk31dvp4+2iLSO/8F1ViEyYmW7t0Zd6ej0gdXG+uV?=
 =?us-ascii?Q?lPe9NlbURPkbVmjt9Ah47q9tpTSsBTQqtUkisohVfvppd6bXA5jFp4RS4mY7?=
 =?us-ascii?Q?WrH3VHf5svCvSmL/2Uoq4mH2sxICRLwJQM3AbiBI1O5v9cJzIjYBFRgvD4qP?=
 =?us-ascii?Q?tY0CoZDWR3kNQRVPzwvanDuMzWzuDZkwrUXii80BpBnAIJDqK02w+KumKVed?=
 =?us-ascii?Q?pPlwPffwZfIBVjf8H5y9DAIzcb2bRfOehTh+oWNaLyj0VEjN/E2aoLS8bdt4?=
 =?us-ascii?Q?4jOgK1hKYSo4qCN9ZpiRzLHEq8ykqchdsR3UJLSD+Q65DaFcgwCMusmrMOTP?=
 =?us-ascii?Q?Eoa+KcqL1b+J0xWcagQk/zRI7OpH39SdxwhKv4zW/m4CiFx7L6Jdiou2sPFf?=
 =?us-ascii?Q?qa9BhsfKYI+70cXfFvaexBhWwAdYibll4curdQd6GPovGyQuosM+66/k2DW+?=
 =?us-ascii?Q?GhONoA=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c6b4bf62-e630-4ddf-5d9a-08d99e040631
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2021 13:23:57.2760
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: nvmG2/jwuYrNconN5gRsuGUzL2xoHWawOqyCIjbJhpQOO7gXXfGkSaFhmyXZ1YzNPm42NP4PxJkQafhpBkPTdSjh4Y4mdTCaV6FCO9aiLoM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR10MB1565
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10155 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=679 mlxscore=0 adultscore=0
 spamscore=0 bulkscore=0 phishscore=0 suspectscore=0 malwarescore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2110150000
 definitions=main-2111020079
X-Proofpoint-ORIG-GUID: 8j4qCOCfcB1rjMDQB58bKiQ4fF6aS799
X-Proofpoint-GUID: 8j4qCOCfcB1rjMDQB58bKiQ4fF6aS799
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Oct 15, 2021 at 04:38:11PM -0700, Todd Kjos wrote:
> When freeing txn buffers, binder_transaction_buffer_release()
> attempts to detect whether the current context is the target by
> comparing current->group_leader to proc->tsk. This is an unreliable
> test. Instead explicitly pass an 'is_failure' boolean.
> 
> Detecting the sender was being used as a way to tell if the
> transaction failed to be sent.  When cleaning up after
> failing to send a transaction, there is no need to close
> the fds associated with a BINDER_TYPE_FDA object. Now
> 'is_failure' can be used to accurately detect this case.
> 

It's really hard for me to understand what this bug looks like to the
user?  Is it a memory leak or do we free the wrong thing?

regards,
dan carpenter