github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

rust_binder: Implement BINDER_DEBUG_USER_ERROR for transaction parsing failures

Browse Source 
This adds dynamic debug logs in `thread.rs` for:
- File descriptor array (FDA) parent offset and parent buffer address
  alignment misalignments.
- Memory copy, write, and translation failures during transaction
  serialization (including out-of-bounds pointer fixups).
- Incoming transactions or replies that do not match the expected
  thread calling stack (such as out-of-order replies).

Reviewed-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Jahnavi MN <jahnavimn@google.com>
Link: https://patch.msgid.link/20260716-rust_binder_debug_mask-v4-4-3d7436c2d2f2@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jahnavi MN 2026-07-16 08:37:46 +00:00 committed by Greg Kroah-Hartman
parent 11071c63a9
commit e49c203bce
1 changed files with 32 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
drivers/android/binder/thread.rs
View File

@ -728,11 +728,12 @@ fn translate_object(
let alloc_offset = match sg_state.unused_buffer_space.claim_next(obj_length) {
Ok(alloc_offset) => alloc_offset,
Err(err) => {
pr_warn!(
"Failed to claim space for a BINDER_TYPE_PTR. (offset: {}, limit: {}, size: {})",
binder_debug!(
UserError,
"failed to claim space for a BINDER_TYPE_PTR (offset: {}, limit: {}, size: {})",
sg_state.unused_buffer_space.offset,
sg_state.unused_buffer_space.limit,
obj_length,
obj_length
);
return Err(err.into());
}
@ -811,6 +812,7 @@ fn translate_object(
let fds_len = num_fds.checked_mul(size_of::<u32>()).ok_or(EINVAL)?;
if !is_aligned(parent_offset, size_of::<u32>()) {
binder_debug!(UserError, "FDA parent offset not aligned correctly");
return Err(EINVAL.into());
}
@ -829,6 +831,7 @@ fn translate_object(
};
if !is_aligned(parent_entry.sender_uaddr, size_of::<u32>()) {
binder_debug!(UserError, "FDA parent buffer not aligned correctly");
return Err(EINVAL.into());
}
@ -912,12 +915,9 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let target_offset_end = fixup_offset.checked_add(fixup_len).ok_or(EINVAL)?;
if fixup_offset < end_of_previous_fixup || offset_end < target_offset_end {
pr_warn!(
"Fixups oob {} {} {} {}",
fixup_offset,
end_of_previous_fixup,
offset_end,
target_offset_end
binder_debug!(
UserError,
"fixups oob {fixup_offset} {end_of_previous_fixup} {offset_end} {target_offset_end}"
);
return Err(EINVAL.into());
}
@ -925,18 +925,21 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let copy_off = end_of_previous_fixup;
let copy_len = fixup_offset - end_of_previous_fixup;
if let Err(err) = alloc.copy_into(&mut reader, copy_off, copy_len) {
pr_warn!("Failed copying into alloc: {:?}", err);
binder_debug!(UserError, "failed copying into alloc: {err:?}");
return Err(err.into());
}
if let PointerFixupEntry::Fixup { pointer_value, .. } = fixup {
let res = alloc.write::<u64>(fixup_offset, pointer_value);
if let Err(err) = res {
pr_warn!("Failed copying ptr into alloc: {:?}", err);
binder_debug!(UserError, "failed copying ptr into alloc: {err:?}");
return Err(err.into());
}
}
if let Err(err) = reader.skip(fixup_len) {
pr_warn!("Failed skipping {} from reader: {:?}", fixup_len, err);
binder_debug!(
UserError,
"failed skipping {fixup_len} from reader: {err:?}"
);
return Err(err.into());
}
end_of_previous_fixup = target_offset_end;
@ -944,7 +947,7 @@ fn apply_sg(&self, alloc: &mut Allocation, sg_state: &mut ScatterGatherState) ->
let copy_off = end_of_previous_fixup;
let copy_len = offset_end - end_of_previous_fixup;
if let Err(err) = alloc.copy_into(&mut reader, copy_off, copy_len) {
pr_warn!("Failed copying remainder into alloc: {:?}", err);
binder_debug!(UserError, "failed copying remainder into alloc: {err:?}");
return Err(err.into());
}
}
@ -1048,7 +1051,7 @@ pub(crate) fn copy_transaction_data(
let offset: usize = offset.try_into().map_err(|_| EINVAL)?;
if offset < end_of_previous_object || !is_aligned(offset, size_of::<u32>()) {
pr_warn!("Got transaction with invalid offset.");
binder_debug!(UserError, "got transaction with invalid offset");
return Err(EINVAL.into());
}
@ -1073,7 +1076,7 @@ pub(crate) fn copy_transaction_data(
) {
Ok(()) => end_of_previous_object = offset + object.size(),
Err(err) => {
pr_warn!("Error while translating object.");
binder_debug!(UserError, "error while translating object: {err:?}");
return Err(err);
}
}
@ -1093,15 +1096,12 @@ pub(crate) fn copy_transaction_data(
)?;
if let Some(sg_state) = sg_state.as_mut() {
if let Err(err) = self.apply_sg(&mut alloc, sg_state) {
pr_warn!("Failure in apply_sg: {:?}", err);
return Err(err);
}
self.apply_sg(&mut alloc, sg_state)?;
}
if let Some((off_out, secctx)) = secctx.as_mut() {
if let Err(err) = alloc.write(secctx_off, secctx.as_bytes()) {
pr_warn!("Failed to write security context: {:?}", err);
binder_debug!(UserError, "failed to write security context: {err:?}");
return Err(err.into());
}
**off_out = secctx_off;
@ -1303,7 +1303,7 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
{
let mut inner = self.inner.lock();
if !transaction.is_stacked_on(&inner.current_transaction) {
pr_warn!("Transaction stack changed during transaction!");
binder_debug!(UserError, "got new transaction with bad transaction stack");
return Err(EINVAL.into());
}
inner.current_transaction = Some(transaction.clone_arc());
@ -1326,8 +1326,18 @@ fn transaction_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResu
}
fn reply_inner(self: &Arc<Self>, info: &mut TransactionInfo) -> BinderResult {
let orig = self.inner.lock().pop_transaction_to_reply(self)?;
let orig = match self.inner.lock().pop_transaction_to_reply(self) {
Ok(orig) => orig,
Err(err) => {
binder_debug!(UserError, "got reply transaction with no transaction stack");
return Err(err.into());
}
};
if !orig.from.is_current_transaction(&orig) {
binder_debug!(
UserError,
"got reply transaction with bad transaction stack"
);
return Err(EINVAL.into());
}