samsung_sm8750/android_kernel_samsung_sm8750
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BACKPORT: binder: Create safe versions of binder log files

Browse Source 
Binder defines several seq_files that can be accessed via debugfs or
binderfs. Some of these files (e.g., 'state' and 'transactions')
contain more granular information about binder's internal state that
is helpful for debugging, but they also leak userspace address data
through user-defined 'cookie' or 'ptr' values. Consequently, access
to these files must be heavily restricted.

Add two new files, 'state_hashed' and 'transactions_hashed', that
reproduce the information in the original files but use the kernel's
raw pointer obfuscation to hash any potential user addresses. This
approach allows systems to grant broader access to the new files
without having to change the security policy around the existing ones.

In practice, userspace populates these fields with user addresses, but
within the driver, these values only serve as unique identifiers for
their associated binder objects. Consequently, binder logs can
obfuscate these values and still retain meaning. While this strategy
prevents leaking information about the userspace memory layout in the
existing log files, it also decouples log messages about binder
objects from their user-defined identifiers.

Acked-by: Carlos Llamas <cmllamas@google.com>
Tested-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: "Tiffany Y. Yang" <ynaffit@google.com>
Link: https://lore.kernel.org/r/20250510013435.1520671-7-ynaffit@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Bug: 316970771
(cherry picked from commit 57483a362741e4f0f3f4d2fc82d48f82fd0986d9)
[Resolve conflicts from node prio]
Change-Id: I6a01048c0105a1d6061e95f386e7ee55e2fdc898
Signed-off-by: "Tiffany Yang" <ynaffit@google.com>
This commit is contained in:
Tiffany Y. Yang
2025-05-10 01:34:40 +00:00
committed by Treehugger Robot
parent 8a55e7a02a
commit 86ba3f3eb2
1 changed files with 79 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
drivers/android/binder.c
View File

@@ -6645,7 +6645,7 @@ static void print_binder_work_ilocked(struct seq_file *m,
struct binder_proc *proc, struct binder_proc *proc,
const char *prefix, const char *prefix,
const char *transaction_prefix, const char *transaction_prefix,
struct binder_work *w) struct binder_work *w, bool hash_ptrs)
{ {
struct binder_node *node; struct binder_node *node;
struct binder_transaction *t; struct binder_transaction *t;
@@ -6668,6 +6668,12 @@ static void print_binder_work_ilocked(struct seq_file *m,
break; break;
case BINDER_WORK_NODE: case BINDER_WORK_NODE:
node = container_of(w, struct binder_node, work); node = container_of(w, struct binder_node, work);
if (hash_ptrs)
seq_printf(m, "%snode work %d: u%p c%p\n",
prefix, node->debug_id,
(void *)(long)node->ptr,
(void *)(long)node->cookie);
else
seq_printf(m, "%snode work %d: u%016llx c%016llx\n", seq_printf(m, "%snode work %d: u%016llx c%016llx\n",
prefix, node->debug_id, prefix, node->debug_id,
(u64)node->ptr, (u64)node->cookie); (u64)node->ptr, (u64)node->cookie);
@@ -6695,7 +6701,7 @@ static void print_binder_work_ilocked(struct seq_file *m,
static void print_binder_thread_ilocked(struct seq_file *m, static void print_binder_thread_ilocked(struct seq_file *m,
struct binder_thread *thread, struct binder_thread *thread,
bool print_always) bool print_always, bool hash_ptrs)
{ {
struct binder_transaction *t; struct binder_transaction *t;
struct binder_work *w; struct binder_work *w;
@@ -6725,14 +6731,16 @@ static void print_binder_thread_ilocked(struct seq_file *m,
} }
list_for_each_entry(w, &thread->todo, entry) { list_for_each_entry(w, &thread->todo, entry) {
print_binder_work_ilocked(m, thread->proc, " ", print_binder_work_ilocked(m, thread->proc, " ",
" pending transaction", w); " pending transaction",
w, hash_ptrs);
} }
if (!print_always && m->count == header_pos) if (!print_always && m->count == header_pos)
m->count = start_pos; m->count = start_pos;
} }
static void print_binder_node_nilocked(struct seq_file *m, static void print_binder_node_nilocked(struct seq_file *m,
struct binder_node *node) struct binder_node *node,
bool hash_ptrs)
{ {
struct binder_ref *ref; struct binder_ref *ref;
struct binder_work *w; struct binder_work *w;
@@ -6742,8 +6750,13 @@ static void print_binder_node_nilocked(struct seq_file *m,
hlist_for_each_entry(ref, &node->refs, node_entry) hlist_for_each_entry(ref, &node->refs, node_entry)
count++; count++;
seq_printf(m, " node %d: u%016llx c%016llx pri %d:%d hs %d hw %d ls %d lw %d is %d iw %d tr %d", if (hash_ptrs)
node->debug_id, (u64)node->ptr, (u64)node->cookie, seq_printf(m, " node %d: u%p c%p", node->debug_id,
(void *)(long)node->ptr, (void *)(long)node->cookie);
else
seq_printf(m, " node %d: u%016llx c%016llx", node->debug_id,
(u64)node->ptr, (u64)node->cookie);
seq_printf(m, " pri %d:%d hs %d hw %d ls %d lw %d is %d iw %d tr %d",
node->sched_policy, node->min_priority, node->sched_policy, node->min_priority,
node->has_strong_ref, node->has_weak_ref, node->has_strong_ref, node->has_weak_ref,
node->local_strong_refs, node->local_weak_refs, node->local_strong_refs, node->local_weak_refs,
@@ -6757,7 +6770,8 @@ static void print_binder_node_nilocked(struct seq_file *m,
if (node->proc) { if (node->proc) {
list_for_each_entry(w, &node->async_todo, entry) list_for_each_entry(w, &node->async_todo, entry)
print_binder_work_ilocked(m, node->proc, " ", print_binder_work_ilocked(m, node->proc, " ",
" pending async transaction", w); " pending async transaction",
w, hash_ptrs);
} }
} }
@@ -6779,6 +6793,7 @@ static void print_binder_ref_olocked(struct seq_file *m,
* @proc: struct binder_proc we hold the inner_proc_lock to (if any) * @proc: struct binder_proc we hold the inner_proc_lock to (if any)
* @node: struct binder_node to print fields of * @node: struct binder_node to print fields of
* @prev_node: struct binder_node we hold a temporary reference to (if any) * @prev_node: struct binder_node we hold a temporary reference to (if any)
* @hash_ptrs: whether to hash @node's binder_uintptr_t fields
* *
* Helper function to handle synchronization around printing a struct * Helper function to handle synchronization around printing a struct
* binder_node while iterating through @proc->nodes or the dead nodes list. * binder_node while iterating through @proc->nodes or the dead nodes list.
@@ -6791,7 +6806,7 @@ static void print_binder_ref_olocked(struct seq_file *m,
static struct binder_node * static struct binder_node *
print_next_binder_node_ilocked(struct seq_file *m, struct binder_proc *proc, print_next_binder_node_ilocked(struct seq_file *m, struct binder_proc *proc,
struct binder_node *node, struct binder_node *node,
struct binder_node *prev_node) struct binder_node *prev_node, bool hash_ptrs)
{ {
/* /*
* Take a temporary reference on the node so that isn't freed while * Take a temporary reference on the node so that isn't freed while
@@ -6809,7 +6824,7 @@ print_next_binder_node_ilocked(struct seq_file *m, struct binder_proc *proc,
if (prev_node) if (prev_node)
binder_put_node(prev_node); binder_put_node(prev_node);
binder_node_inner_lock(node); binder_node_inner_lock(node);
print_binder_node_nilocked(m, node); print_binder_node_nilocked(m, node, hash_ptrs);
binder_node_inner_unlock(node); binder_node_inner_unlock(node);
if (proc) if (proc)
binder_inner_proc_lock(proc); binder_inner_proc_lock(proc);
@@ -6819,7 +6834,7 @@ print_next_binder_node_ilocked(struct seq_file *m, struct binder_proc *proc,
} }
static void print_binder_proc(struct seq_file *m, struct binder_proc *proc, static void print_binder_proc(struct seq_file *m, struct binder_proc *proc,
bool print_all) bool print_all, bool hash_ptrs)
{ {
struct binder_work *w; struct binder_work *w;
struct rb_node *n; struct rb_node *n;
@@ -6834,7 +6849,7 @@ static void print_binder_proc(struct seq_file *m, struct binder_proc *proc,
binder_inner_proc_lock(proc); binder_inner_proc_lock(proc);
for (n = rb_first(&proc->threads); n; n = rb_next(n)) for (n = rb_first(&proc->threads); n; n = rb_next(n))
print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread, print_binder_thread_ilocked(m, rb_entry(n, struct binder_thread,
rb_node), print_all); rb_node), print_all, hash_ptrs);
for (n = rb_first(&proc->nodes); n; n = rb_next(n)) { for (n = rb_first(&proc->nodes); n; n = rb_next(n)) {
struct binder_node *node = rb_entry(n, struct binder_node, struct binder_node *node = rb_entry(n, struct binder_node,
@@ -6843,7 +6858,8 @@ static void print_binder_proc(struct seq_file *m, struct binder_proc *proc,
continue; continue;
last_node = print_next_binder_node_ilocked(m, proc, node, last_node = print_next_binder_node_ilocked(m, proc, node,
last_node); last_node,
hash_ptrs);
} }
binder_inner_proc_unlock(proc); binder_inner_proc_unlock(proc);
if (last_node) if (last_node)
@@ -6861,7 +6877,8 @@ static void print_binder_proc(struct seq_file *m, struct binder_proc *proc,
binder_inner_proc_lock(proc); binder_inner_proc_lock(proc);
list_for_each_entry(w, &proc->todo, entry) list_for_each_entry(w, &proc->todo, entry)
print_binder_work_ilocked(m, proc, " ", print_binder_work_ilocked(m, proc, " ",
" pending transaction", w); " pending transaction", w,
hash_ptrs);
list_for_each_entry(w, &proc->delivered_death, entry) { list_for_each_entry(w, &proc->delivered_death, entry) {
seq_puts(m, " has delivered dead binder\n"); seq_puts(m, " has delivered dead binder\n");
break; break;
@@ -7037,7 +7054,7 @@ static void print_binder_proc_stats(struct seq_file *m,
print_binder_stats(m, " ", &proc->stats); print_binder_stats(m, " ", &proc->stats);
} }
static int state_show(struct seq_file *m, void *unused) static void print_binder_state(struct seq_file *m, bool hash_ptrs)
{ {
struct binder_proc *proc; struct binder_proc *proc;
struct binder_node *node; struct binder_node *node;
@@ -7050,16 +7067,38 @@ static int state_show(struct seq_file *m, void *unused)
seq_puts(m, "dead nodes:\n"); seq_puts(m, "dead nodes:\n");
hlist_for_each_entry(node, &binder_dead_nodes, dead_node) hlist_for_each_entry(node, &binder_dead_nodes, dead_node)
last_node = print_next_binder_node_ilocked(m, NULL, node, last_node = print_next_binder_node_ilocked(m, NULL, node,
last_node); last_node,
hash_ptrs);
spin_unlock(&binder_dead_nodes_lock); spin_unlock(&binder_dead_nodes_lock);
if (last_node) if (last_node)
binder_put_node(last_node); binder_put_node(last_node);
mutex_lock(&binder_procs_lock); mutex_lock(&binder_procs_lock);
hlist_for_each_entry(proc, &binder_procs, proc_node) hlist_for_each_entry(proc, &binder_procs, proc_node)
print_binder_proc(m, proc, true); print_binder_proc(m, proc, true, hash_ptrs);
mutex_unlock(&binder_procs_lock); mutex_unlock(&binder_procs_lock);
}
static void print_binder_transactions(struct seq_file *m, bool hash_ptrs)
{
struct binder_proc *proc;
seq_puts(m, "binder transactions:\n");
mutex_lock(&binder_procs_lock);
hlist_for_each_entry(proc, &binder_procs, proc_node)
print_binder_proc(m, proc, false, hash_ptrs);
mutex_unlock(&binder_procs_lock);
}
static int state_show(struct seq_file *m, void *unused)
{
print_binder_state(m, false);
return 0;
}
static int state_hashed_show(struct seq_file *m, void *unused)
{
print_binder_state(m, true);
return 0; return 0;
} }
@@ -7081,14 +7120,13 @@ static int stats_show(struct seq_file *m, void *unused)
static int transactions_show(struct seq_file *m, void *unused) static int transactions_show(struct seq_file *m, void *unused)
{ {
struct binder_proc *proc; print_binder_transactions(m, false);
return 0;
seq_puts(m, "binder transactions:\n"); }
mutex_lock(&binder_procs_lock);
hlist_for_each_entry(proc, &binder_procs, proc_node)
print_binder_proc(m, proc, false);
mutex_unlock(&binder_procs_lock);
static int transactions_hashed_show(struct seq_file *m, void *unused)
{
print_binder_transactions(m, true);
return 0; return 0;
} }
@@ -7101,7 +7139,7 @@ static int proc_show(struct seq_file *m, void *unused)
hlist_for_each_entry(itr, &binder_procs, proc_node) { hlist_for_each_entry(itr, &binder_procs, proc_node) {
if (itr->pid == pid) { if (itr->pid == pid) {
seq_puts(m, "binder proc state:\n"); seq_puts(m, "binder proc state:\n");
print_binder_proc(m, itr, true); print_binder_proc(m, itr, true, false);
} }
} }
mutex_unlock(&binder_procs_lock); mutex_unlock(&binder_procs_lock);
@@ -7168,8 +7206,10 @@ const struct file_operations binder_fops = {
}; };
DEFINE_SHOW_ATTRIBUTE(state); DEFINE_SHOW_ATTRIBUTE(state);
DEFINE_SHOW_ATTRIBUTE(state_hashed);
DEFINE_SHOW_ATTRIBUTE(stats); DEFINE_SHOW_ATTRIBUTE(stats);
DEFINE_SHOW_ATTRIBUTE(transactions); DEFINE_SHOW_ATTRIBUTE(transactions);
DEFINE_SHOW_ATTRIBUTE(transactions_hashed);
DEFINE_SHOW_ATTRIBUTE(transaction_log); DEFINE_SHOW_ATTRIBUTE(transaction_log);
const struct binder_debugfs_entry binder_debugfs_entries[] = { const struct binder_debugfs_entry binder_debugfs_entries[] = {
@@ -7179,6 +7219,12 @@ const struct binder_debugfs_entry binder_debugfs_entries[] = {
.fops = &state_fops, .fops = &state_fops,
.data = NULL, .data = NULL,
}, },
{
.name = "state_hashed",
.mode = 0444,
.fops = &state_hashed_fops,
.data = NULL,
},
{ {
.name = "stats", .name = "stats",
.mode = 0444, .mode = 0444,
@@ -7191,6 +7237,12 @@ const struct binder_debugfs_entry binder_debugfs_entries[] = {
.fops = &transactions_fops, .fops = &transactions_fops,
.data = NULL, .data = NULL,
}, },
{
.name = "transactions_hashed",
.mode = 0444,
.fops = &transactions_hashed_fops,
.data = NULL,
},
{ {
.name = "transaction_log", .name = "transaction_log",
.mode = 0444, .mode = 0444,