Re: [PATCH] binder: cache secctx size before release zeroes it

[Alice Ryhl <aliceryhl@google.com>]

On Wed, Jun 03, 2026 at 10:44:54AM -0700, Chris Mason wrote:
> binder_transaction() bounds the scatter-gather buffer area with
> sg_buf_end_offset and subtracts the aligned LSM context size because
> the secctx is written at the tail of that area.  The subtraction reads
> lsmctx.len, but that field has already been cleared by the time the
> line runs:
> 
>     security_secid_to_secctx(secid, &lsmctx)   /* lsmctx.len set */
>     lsmctx_aligned_size = ALIGN(lsmctx.len, sizeof(u64))
>     extra_buffers_size += lsmctx_aligned_size
>     ...
>     security_release_secctx(&lsmctx)            /* memset zeroes len */
>     ...
>     sg_buf_end_offset = sg_buf_offset + extra_buffers_size
>                         - ALIGN(lsmctx.len, sizeof(u64)) /* ALIGN(0,8) */
> 
> security_release_secctx() does memset(cp, 0, sizeof(*cp)), so lsmctx.len
> reads back as 0 and the subtraction contributes nothing, leaving
> sg_buf_end_offset too large by the aligned secctx size on every
> transaction to a txn_security_ctx node.
> 
> Each BINDER_TYPE_PTR object then derives buf_left = sg_buf_end_offset -
> sg_buf_offset as the sole upper bound on its copy, so the inflated end
> offset lets the copy run into the bytes that already hold the secctx.
> 
> The aligned size must therefore be cached before release rather than
> re-read from the now-cleared field.  Fix by caching it in
> lsmctx_aligned_size at function scope when it is first computed and
> subtracting lsmctx_aligned_size instead of re-reading lsmctx.len after
> release.  Reuse the same value for the earlier buf_offset computation.
> 
> Fixes: 6fba89813ccf ("lsm: ensure the correct LSM context releaser")
> Cc: stable@vger.kernel.org
> Assisted-by: kres:claude-opus-4-8
> Signed-off-by: Chris Mason <clm@meta.com>

Reviewed-by: Alice Ryhl <aliceryhl@google.com>