From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Carlos Llamas <cmllamas@google.com>
Cc: stable@kernel.org, linux-kernel@vger.kernel.org,
kernel-team@android.com, Zi Fan Tan <zifantan@google.com>,
Todd Kjos <tkjos@google.com>
Subject: Re: [PATCH 5.10 0/6] binder: backports for data leak and UAF
Date: Wed, 30 Nov 2022 13:42:23 +0100 [thread overview]
Message-ID: <Y4dPrxKjnUOtvwIc@kroah.com> (raw)
In-Reply-To: <20221130035805.1823970-1-cmllamas@google.com>
On Wed, Nov 30, 2022 at 03:57:59AM +0000, Carlos Llamas wrote:
> This series of backports consists of 3 main patches from Todd submitted
> upstream in [1]. The intention is to avoid untranslated data from the
> senders to be visible to the target processes. More details of this
> issue can be found in the same thread.
>
> Furthermore, Todd's patches also fix a use-after-free issue introduced
> by commit 32e9f56a96d8 ("binder: don't detect sender/target during
> buffer cleanup"). In which invalid userspace input causes unprocessed
> objects to be incorrectly released. Any subsequent references to these
> objects will trigger a UAF as noted by the following KASAN trace:
>
> [ 244.748468] ==================================================================
> [ 244.750486] BUG: KASAN: use-after-free in binder_ioctl+0xb88/0x32e0
> [ 244.751276] Read of size 8 at addr ffff67b1865bea58 by task poc/593
> [ 244.752074]
> [ 244.752725] CPU: 0 PID: 593 Comm: poc Not tainted 5.10.156 #1
> [ 244.753683] Hardware name: linux,dummy-virt (DT)
> [ 244.754717] Call trace:
> [ 244.755216] dump_backtrace+0x0/0x2a0
> [ 244.755836] show_stack+0x18/0x2c
> [ 244.756306] dump_stack+0xf8/0x164
> [ 244.756807] print_address_description.constprop.0+0x9c/0x538
> [ 244.757590] kasan_report+0x120/0x200
> [ 244.758236] __asan_load8+0xa0/0xc4
> [ 244.758756] binder_ioctl+0xb88/0x32e0
> [ 244.759283] __arm64_sys_ioctl+0xd4/0x120
> [ 244.759677] el0_svc_common.constprop.0+0xac/0x270
> [ 244.760184] do_el0_svc+0x38/0xa0
> [ 244.760540] el0_svc+0x1c/0x2c
> [ 244.760898] el0_sync_handler+0xe8/0x114
> [ 244.761419] el0_sync+0x180/0x1c0
>
> This second issue along with the reference to the commit fixing it was
> first reported by Zi Fan.
>
> The other 3 commits included in this series are simply upstream fixes
> for the main patches.
>
> I've tested this series applied to 5.10 and 5.4 which fixes the issues
> above as expected. So please pick these up for 5.10 and 5.4 stable.
>
> [1] https://lore.kernel.org/all/20211130185152.437403-1-tkjos@google.com/
>
> Thanks,
> Carlos Llamas
>
> Cc: Zi Fan Tan <zifantan@google.com>
> Cc: Todd Kjos <tkjos@google.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All now queued up, thanks.
greg k-h
next prev parent reply other threads:[~2022-11-30 12:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-30 3:57 [PATCH 5.10 0/6] binder: backports for data leak and UAF Carlos Llamas
2022-11-30 3:58 ` [PATCH 5.10 1/6] binder: avoid potential data leakage when copying txn Carlos Llamas
2022-11-30 3:58 ` [PATCH 5.10 2/6] binder: read pre-translated fds from sender buffer Carlos Llamas
2022-11-30 3:58 ` [PATCH 5.10 3/6] binder: defer copies of pre-patched txn data Carlos Llamas
2022-11-30 3:58 ` [PATCH 5.10 4/6] binder: fix pointer cast warning Carlos Llamas
2022-11-30 3:58 ` [PATCH 5.10 5/6] binder: Address corner cases in deferred copy and fixup Carlos Llamas
2022-11-30 3:58 ` [PATCH 5.10 6/6] binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 Carlos Llamas
2022-11-30 12:42 ` Greg Kroah-Hartman [this message]
2022-11-30 16:12 ` [PATCH 5.10 0/6] binder: backports for data leak and UAF Carlos Llamas
2022-11-30 16:33 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y4dPrxKjnUOtvwIc@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=cmllamas@google.com \
--cc=kernel-team@android.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@kernel.org \
--cc=tkjos@google.com \
--cc=zifantan@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox